(19) 



J 



Europaisches Patentamt 
European Patent Office 
Office europeen dee brevets 




(12) 



(11) EP 0 542 298 B1 

EUROPEAN PATENT SPECIFICATION 



(45) Date of publication and mention 
of the grant of the patent: 
22.04.1998 Bulletin 1998/17 

(21) Application number: 92119461.9 

(22) Date of filing: 13.11.1992 



(51) lnlCI.6: G06F 17/60, G07F 7/10 



(54) Electronic monetary system 

Elektronisches Zahlungsverkehrsystem 
Systeme fiduciaire 6lectronique 



(84) Designated Contracting States: 

AT BE CH DE DK ES FR QBGR IE IT LI LU MC NI- 
PT SE 

(30) Priority: 15.11.t991 US 794112 

(43) Date of publication of application: 
19.05.1993 Bulletin 1993/20 

(60) Divisional application: 971 05388.9 / 0 788 066 

97105385.5/0785 515 
97105386.3/0785 516 
97105387.1/0 785 517 



CD 

CO 

o> 

CM 
CNJ 

U> 

o 

LU 



(73) Proprietor CITIBANK, N.A. 
New York, New York 10043 (US) 

(72) Inventor: Rosen, Sholom S. 
NY-New York 10024 (US) 

(74) Representative: Motyneaux, Martyn William et al 
c/o Ladas & Parry, 

52-54 High Holborn 
London WC1V6RR (GB) 



(56) References cited: 
EP-A- 0172 670 
WO-A-83/D3018 
US-A-4 320 387 



EP-A- 0 421 808 
WO-A-91/16691 
US-A- 4 625 276 



Note: Within nine months from (he publication of the mention of the grant of the European patent, any person may give 
notice to the European Patent Office of opposition to the European patent granted. Notice of opposition shall be filed in 
a written reasoned statement. It shall not be deemed to have been filed until the opposition fee has been paid. (Art. 
99(1) European Patent Convention). 



Prhied by Jotwe. 7S001 PARTS [FR) 



EP 0 542 298 B1 



embodied as a national or international consumer banking system. The reference does not disclose any means for 
backing the electronic representations of economic value with equal valued liabilities as the counterpart to their assets. 

European Patent Publication 421 ,808 discloses a system for transferring funds. The system uses a terminal under 
program control to move electronic representations of funds between portable data storage devices. The storage de- 
vices are embodied as "smart cards'. The system allows the transfer of funds from a financial institution to a cardholder, 
from the cardholder to a retailer, and from the retailer to a second financial institution. 

None of paperless payment systems that have been proposed so far are comprehensive enough so as to implement 
a multipurpose electronic monetary system that includes not only the automated devices that allow subscribers to 
transfer electronic funds or money between them without any intermediating system, but that also encompasses and 
includes an entire banking system for generating the value represented by the electronic money and for clearing and 
settling the electronic money accounts of the banks and financial institutions involved to maintah a monetary balance 
within the system. 

Thus specifically, there is a need for a system that allows common payor to payee transactions without the inter- 
mediation ol the banking system, and that gives control of the payment process to the individual. Furthermore, a need 
exists for providing a system of economic exchange that can be used by large organizations for commercial payments 
of any size, that does not have the limitations of the current EFT systems. 

Accordingly, it is an object of the present invention to overcome the aforesaid shortfalls by providing a complete 
electronic monetary system which utilizes electronic money that is interchangeable with traditional cash and is univer- 
sally accepted. 

The electronic monetary systems according to the present invention are defined by the appended independent 
claims. 

The present invention provides for securely transferring economic value Including currency and credit among sub- 
scrtoers. among financial institutions, and between subscribers and financial institutions. The system provided is a 
paperless system whereby transactions can be carried out in both an on-line and an off-line mode between subscribers. 
The system reduces the cost of central electronic funds transfer systems by off loading much of the payments to off- 
line devices. The system provides for inexpensive electronic transfers to reduce an institution's cost of managing paper 
cash, checks and coins. Further, the invention provides a user friendly electronic payment system that may be used 
reliably and securely for real time transfers of money between members of the general public, between members of 
the general public and commercial organizations, and between commercial organizations. The system may be inte- 
grated with a wide variety of data processing and data communication systems including currently available home 
banking services. Further, the system can be utilized with electronic money in the form of multiple currencies and in 
transactions of virtually-any size denomination. Further the medium of economic exchange provided is fungible, easily 
transferable, undeniably redeemable, and secure from reuse, duplication, and counterfeiting. 

The foregoing features and advantages of the invention are illustrative of those which can be achieved by the 
present invention and are not intended to be exhaustive or limiting of the possible advantages which can be realized. 
Thus, these and other features and advantages of the invention will be apparent from the description herein or can be 
learned from practicing the invention, both as embodied herein or as modified in view of any variations which may be 
apparent to those skilled in the art. 

Summary of Exemplary Embodiment 

To achieve the foregoing, and other objecis, the apparatuses of the present invention employ a preferred embod- 
iment in the form of an electronic-monetary system having (1 ) banks or financial institutions that are coupled to a money 
generator device for generating and issuing to subscribing customers electronic money including electrons currency 
backed by demand deposits and electronic credit authorizations; (2) correspondent banks that accept and distribute 
the electronic money; (3) a plurality of transaction devices that are used by subscribers for storing electronic money 
for performing money transactions with the on-line systems of the participating banks or for exchanging electronic 
money with other like transaction devices in off-line transactions; (4) teller devices, associated with the issuing and 
correspondent banks, for process handling and interfacing the transaction devices to the issuing and correspondent 
banks, and for interlacing between the issuing and correspondent banks themselves; (5) a clearing bank for balancing 
the electronic money accounts of the different issuing banks; (6) a data communications network for providing com- 
munications services to all components of the system; and (7) a security arrangement for maintaining the integrity of 
the system, and for detecting counterfeiting and tampering within the system. 

In the preferred embodiment the f unctions of the money generating devices, the transaction devices, and the teller 
devices will be performed by a combination of tamper-proof computer hardware and application software modules that 
may be networked together. Information is transmitted in an encrypted form to provide security from unauthorized 
inspection. The electronic money is transmitted with digital signatures to provide authentication, and security from 
modification or counterfeiting. 
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Figure 8 is a block diagram of a Network Server, according to the invention. 
Figure 9 is a flow diagram of the security server, according to the invention. 
Figure 10 is a block form diagram of the security server, according to the invention. 
Figure 11-24 are flow diagrams of accounting examples, according to the invention. 
5 Figure 25 a flow diagram of the Transaction Reconciliation System, according to the invention. 

Figure 26 is a flow diagram of the Clearing System, according to the invention. 
Figure 27 is a flow diagram ol the Money Issued Reconciliation System, according to the invention. 
Figure 28-50A are flow charts of transaction examples, according to the invention. 

10 Disclosure of the Preferred Embodiment the Invention 

The present invention contemplates an improved monetary system using electronic media to securely and reliably 
exchange economic value. The system can be Implemented by integrating novel data processing systems with other 
procedures which can be imptemented with the current worldwide banking systems. 
'5 Throughout this description, 'electronic money' may also be referred to by the abbreviation "E-M." Additionally, 
the term 'bank' is used hereinafter to indicate any banking, financial institution or the like which is a participant of the 
present invention. 

Referring now to the drawings, wherein like numerals refer to like components, there is disclosed in Figure 1, in 
block form, broad aspects of the preferred embodiment. In Fig. 1, the general relationship among the features of the 

20 system is shown. The system includes Issuing Banks 1 each having a Teller money module 5 and a Money Generator 
module 6; Correspondent Banks 2 each having a Teller money module 5; an electronic money Clearing Bank 3; a 
Certification Agency 28 and a plurality of Transaction money modules 4 owned by subscribers of the system. Though 
money generator module 6 and teller module 5 are preferably embodied separately, the functions of these modules 
may be embodied In a unitary device processor control. 

2S Electronic notes 11, the media for transierring electronic money, are generated by the Money Generator module 
6 for an Issuing Bank 1. Theses notes 11 are then transferred by a Teller money module 5 to a subscriber utilizing a 
Transaction money module 4. Electronic notes may be representations of currency or credit authorizations For security 
reasons, all electronic notes 11 will expire after a preset time period. Once expired, the notes 11 must be redeemed 
at a participating bank for updated ones before they can be transferred. 

30 An Issuing Bank 1 generates and distributes the electronic notes 11 , and is liable for their redemption. An Issuing 

Bank 1 performs deposits, withdrawals, payments to loans and inquiries for other money modules. 

A Correspondent Bank 2 is a participating bank which distributes electronic money through accounts it maintains 
at Issuing Banks 1 , but does not generate any electronic money, and Is not liable for its redemption. Because it cannot 
generate any electronic money, the Correspondent Bank 2 in the preferred embodiment must make real-time requests 

35 of electronic money from an account it maintains at an Issuing Bank 1 whenever a subscriber wishes to withdraw 
electronic money at a Correspondent Bank 2. 

Conversely, a Correspondent Bank 2 deposits all electronic money deposited by subscribers, to the accounts the 
Correspondent Bank 2 holds at Issuing Banks 1. These accounts will be described hereinafter. A Correspondent Bank 
2, like an Issuing Bank 1, will perform deposits withdrawals, payments to loans and bank inquiries. 

w Notably, an Issuing Bank 1 may also be a Correspondent Bank 2 tor the monetary units that it does not generate. 

For example, an Issuing Bank 1 for electronic dollar notes 11 may be a Correspondent Bank 2 for electronic notes 11 
of yen, marks, issued by other banks etc. 

It is also important to note that the system of the invention can function without correspondent Banks 2. For example, 
a subscriber can eliminate the use of a Correspondent Bank 2 by communicating directly with his/her Issuing Bank 1 

45 when making a deposit, withdrawal, etc. Correspondent Banks 2 are included in the preferred embodiment for the 
practical purpose of expanding distribution of the system while reducing the risks that are inherent in any banking 
system, such as the risks caused by the collapse of a bank issuing money 

The Clearing Bank 3 is utilized when more than one bank is issuing electronic money. According to the invention, 
it is anticipated that more than one bank will be issuing electronic money. Thus, the Clearing Bank 3 Is provided to 
clear the electronic money deposited and to balance accounts it maintains for the Issuing Banks 1 . The Clearing Bank 
3 maintains demand accounts for each Issuing Bank 1 in the system. 

The Certification Agency 28, is the centerpiece of the system security, it provides a process that ■certifies* the 
validity of a money module for a certain period of time by issuing a certificate to each money module. A money module 
must have a valid certificate in order to be able to transact with other money modules 4, 5, 6. 

55 Before the certificate expires, it must be updated so that a subscriber can continue to use his/her transaction money 

module 4. This process makes users of the system establish periodic contact with the Certification Agency 28. 

Periodic contact allows for faster response when tampering with the money modules of the system is delected. To 
this end, the Certification Agency 28 also provides a list of offending or compromised money modules to other money 
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Transaction Reconciliation System22 and an Issuing Bank's 1 Money Issued Reconciliation System 23 for maintaining 
statistical and housekeeping functions. Records of the electronic notes 11 cleared and settled at the Clearng Bank 3 
are also provided to the Money Issued Reconciliation System 23 . From these compilations, a financial position of the 
system can be produced by the Money Position System 24. 
5 Discrepancies and malfunctions are reported to the Security System 21 which downloads the lists ol problem 

money modules to all money modules in the system when they are connected to the Network 25. By carrying this list, 
a Transaction money module 4 will be inhibited from transacting with other suspect Transaction money modules 4, 

Having thus provided an overview of the preferred embodiment, there will now follow a more detailed description 
ol the individual elements and the transactions between them. 

70 

Money modules 

Figure 3 provides several embodiments of external systems or devices for housing money modules. 

In the preferred embodiment, the external system or device will typically contain data display means, data input 
*s means, data processing means, memory storage means, direct connection or contactless bidirectional communications 
means, and the money module packaged in a tamper - proof housing, all interfaced by suitable means for information 
transfer, such as are well known in the art. 

As will be understood, a money module may be embodied as a modular component of any larger processing 
environment while still performing the same functions. For example, Transaction money modules 4 may work as co- 
20 processors embedded in personal portable computer devices like the Hewlett-Packard 95LX, or as coprocessors in 
mainframe computers, workstations, pointof-sate terminals or telephone devices (fixed or portable) connected to a 
network. 

A Teller money module 5 may be embodied as a co-processor in the bank's financial computer systems. The 
Money Generator module 6 could be a separate processing unit networked to the bank, a co- processor in a general 

2$ unit networked to the bank, a co-processor in a general purpose computer, or it may be combined with an Issuing 
Bank's 1 Teller money module S in a larger processor as illustrated by the unitary device 1001 of Figure 1-- 

Because it is anticipated that a money module will be implemented in a separate processing device, it is assumed 
that corresponding interface circuitry would be provided in the host processing device to provide communication be- 
tween the processing device and the money module. 

30 Notably, all classes of money modules contemplated by the invention may be implemented programmatically or 

by direct electricalconnection through customized integrated circuits, or a combination of both, using any of the methods 
known in the industry for providing the lunctions described below without departing from the teachings of the invention. 
Those skilled in the an will appreciate that from the disclosure of the invention provided herein, commercial semicon- 
ductor integrated circuit technology would suggest numerous alternatives for actual implementation of the inventive 

3S functions of the money module that would still be within the scope of the invention. 

Transaction Money Module 

In one embodiment, the Transaction money module 4 may be imbedded in any computer of any size or use, like 
<o those serving as general purpose computers or work-stations, to provide functions not limited to E-M transaction use. 
This latter application will allow for such uses as real-time, off-line payments between personal computing devices, or 
on-line payments for network services such as information retrieval, telephone calls, or for purchasing airline tickets, 
theater tickets, etc. 

In another embodiment the Transaction money module 4 may be imbedded in an individual hand-he Id integrated 
45 circuit unit, such as a personalized hand-held computer that may be readily carried by an individual as though it were 
a wallet. As an illustration , the device of the preferred embodiment may include a keyboard, a pen or stylus, a touch 
screen or voice recognition circuitry as a data input means, an alphanumeric LCD dot matrix display as a display 
means, an infrared optical transceiver as a contactless bidirectional communications means, and an RJ-11 telephone 
jack coupled to modem circuitry as a telephonic communications means. Additionally, the device may also include 
so various electronic processing and storage means lor providing calculator capabilities, for storage and processing data 
of the owner, etc. 

It is important to note that the particular design of the external device is not critical to the invention, and other 
technologies suitable for accomplishing the foregoing functions may also be used For example, an LED instead of an 
LCD display panel may be used; radio, infrared, inductive or capacitive communications methods may be used instead 
55 of direct connection, optical communications methods may be used; etc. 

In general, it is anticipated that any Transaction money module 4 owned by a subscriber will be embodied in a 
self<ontalned, tamper-resistant unit that contains components which are difficult to access, and thus prevent any 
person from improperly examining, counterfeiting or modifying any of its contents or arrangements. For example, in- 
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In the preferred embodiment, every money module will have an identifier. A money module identifier may be thought 
of as the "serial number" of the money module and is never changed. 

It is anticipated that a subscriber may have access to several of the fields of data stored in the Tran Log application, 
such as histories of the amount, date, and type of transfer. Information as to the expiration dale of a certificate may 
s also be accessed by the subscriber so that he/she will be informed as to the need to update or revalidate the money 
module's certificate. 

The Maintain Security application 37 manages a list of money module identifiers that are known to have been 
generally compromised. In particular, this is a list that is distributed to each money module when it communicates with 
the Network 25, and is a list of money modules that have passed an invalid or counterfeit electronic note 11 or have 
to performed acts deemed detrimental to the system. 

When establishing a session between money modules, each money module checks its list of bad money modules 
to see if the other is an offending money module. If the other money module's identifier appears on the list, the com- 
munication is broken off. 

This application also provides the process for obtaining the certificate unique to the money module, for synchro- 
's nlzing the internal clock, and for managing the creation of new cryptography keys. 

The Note Directory 39 application performs the function of keeping track of the location, identification and value 
of each of the electronic notes 11 stored within the money module. A note 11 . whether ft is an electronic currency note 
or an electronic credit note, is the basic unit of electronic money. It is the electronic object representing the economic 
value, the electronic bits that contain the amount, expiration date, note identifier etc. (described in detail below) that 
20 gets digitally signed (described below) and encrypted when being transferred. Both electronic currency notes 11 and 
electronic credit notes 11 may be located by the Note Directory 39. 

The Note Directory application 39 updates the current amounts of electronic notes 11 (both currency and credit), 
after every transfer. A date-of-expiration, a note identification number and an Issuing Bank identifier is also recorded 
with the location of each note 11. 
2$ in summary, the Note Directory 39 keeps track of the note identification number, the Issuing Bank 1 identifier, the 

date-of-expiration of the note 11, the location of the note 11 as stored in the Transaction money module 4, and the 
current amounts of the value of each of the notes 11 stored. These records are maintained for both electronic currency 
and electronic credit. For a credit note 11, the account number of the credit line is also maintained. 

The Notes application 40 manages the storage of the representations of the electronic notes 11 themseh/es, both 

39 currency and credit notes 11 . This application also generates the transfers when notes 1 1 are to be conveyed 

The Packet Manager application 41 manages the construction and formatting of a packet of electronic notes 11 
that are to be transferred to another money module. For example, the Packet Manager 41 will utilize an algorithm so 
that the least number of electronic notes 11 are used to fulfill the requested amount of transfer, with the earliest dated 
electronic notes 11 being used first. Alternatively, when a packet of notes 11 is transferred to the receiving money 
35 module, the Packet Manager 41 application "disassembles* the packet, verifying the date and separating the data 
fields that represent the different electronic notes 11. 

The formatted packet gets several data fields appended to it when electronic notes 11 are "assembled." An identifier 
data field provides the indicia that identifies it as a packet. Additionally, data fields for the total value of the notes 1 1 , 
the number of notes 11, and the individual locations of the notes 11 are provided. 

40 The Verifier application 42 verifies that a received packet contains valid electronic notes 11 before a receiving 
money module accepts them. The Verifier 42 also checks that the total amount received is equal to the sum of the 
electronic notes 11 that are to be transferred. If the total amount and the individual electronic notes 11 are valid, an 
acknowledgment is returned to allow for completion of the transfer. Otherwise, an 'invalid* message is sent, and the 
transfer may be aborted. 

4S Services applications that are provided fall under two categories: Clock/Timer 43 and Cryptography . The Clock/ 

Timer 43 provides output pulses for controlling a transaction timeout, such as the time between the sending of a mes- 
sage and the return of a corresponding message. 

As will be appreciated, when two money modules are communicating, they may be monitoring a time-out protocol. 
For example, after a first money module has sent a message to a second money module, the Session Manager 31 of 

so the first money module ("A") may set a timer for a reply if the Transactor 32 indicates that a reply is required. The 
Session Manager 31 may also number the message sent. This number would appear in the reply message from the 
Session Manager 31 of the second money module CB 1 ). 

If the timer expires before the message has been received, then Session Manager A 31 will query Session Manager 
B 31 to determine if the transaction is still running in B. If B does not reply then Session Manager A 31 will abort the 

55 transaction. If a reply is received that the transaction is proceeding, then the timer will be reset to a new time. If A 
queries B a predetermined number of times without receiving a reply to the original message, then A may abort the 
transaction. 

Separately, this application also maintains the current date and time, both tor user display and for verifying that 
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security involved. 

The Teller money module 5 contains an External Interface 30, a Session Manager 31 , a Transactor 32 and a Money 
Holder 38 that perform similar functions to the corresponding components in the Transaction money module 4 described 
above. 

5 Briefly, the External Interface 30 interlaces the Teller money module 5 to other processing and communications 

means within the Teller money module 5 host processor, the Session Manager 31 acts to control and commit (i.e., 
finalize) or abort a transaction session between the Tefler money module 5 and another money module; the Money 
Holder 38 manages the storing and retrieval of electronic money; and the Transactor 32 manages the application 
functions of a To Teller 34, the Tran Log Mgr. 36, the Maintain Security 37, the To Bank 47, a To Money Generator 46, 

io and the To Transaction 49. . 

The following list describes in brief, the applications contained in the Teller money module 5 that are functionally 
identical to the applications found in the Transaction money module 4: 

- To Teller 34: Interfaces deposit and withdrawal functions to another Teller money module 5 . 
*5 - Tran Log Mgr. 36: Transaction log manager for recording transaction details. 

- Maintain Security 37: Manages the list of compromised money modules, applies for certificates, synchronizes the 
clocks, and manages the creation of new digital keys. 

- Note Directory 39. Keeps track of the location, value and identification of notes 11 by monetary unit. Summary 
totals are also maintained. 

20 - Notes 40: Manages storage for the electronic notes 11 of exchange, and creates the transfers for the notes 11. 

Packet Manager 41: Manages the assembly and dissembfy of a packet to be transferred to a different money 
module. 

Verifier 42: Verifies that a received packet contains valid electronic notes 11 . 

- Clock/Timer 43: Controls transaction timeout, expiration of the validity of the electronic notes 11, expiration of the 
25 certificate, and general clock functions. 

Cryptography 

(i) Public key 44: used for signatures to sign and validate notes 11 and to set up a secure transaction session. 

(ii) Symmetric key 45: Controls the security of a transaction session. 

30 (iii) Random number generator 46: Generates random like numbers for new cryptographic keys. 

Some of Ihs distinguishing applications are the To Bank 47 and To Transaction 49 applications. The To Bank 
application 47 provides the Interfacing means whereby the Teller money module 5 can perform exchanges of data for 
inquiries and account postings with the on-line systems of a bank. This application is also utilized for crosschecking 
3$ the customer's account number with the accounts and type of transaction being requested. 

The To Transaction application 49 performs deposits, withdrawals and payments to loans. This application operates 
whenever a Teller money module 5 is transacting with a subscriber's Transaction money module 4. 

As mentioned above, a Teller money module 6 may be associated with an Issuing Bank 1 or a Correspondent 
Bank 2. When Teller money module 6 is associated with a Correspondent Bank 2, it is utilized for intermediating de~ 
40 posits, withdrawals, and payments to loan accounts between a Transaction money module 4, the Correspondent Bank's 
2 on-line systems, and an Teller money module 6 at an Issuing Bank 1. 

When operating in an Issuing Bank 1 mode, the Teller money module 5 is used for intermediating deposits, with- 
drawals, and payments to loan accounts between other money modules and the Issuing Bank's 1 on-line systems. 
Additionally, when the Teller money module 5 is performing in an Issuing Bank 1 mode, a To Money Generator appli- 
es cation 48 may be employed when requesting new notes 11 . 

Basically, the To Money Generator application 48 performs banking functions dealing with requests for electronic 
notes 11. ft interfaces an Issuing Bank's 1 Teller money module 5 to a Money Generator Module 6. 

All of the other elements performed in an Issuing Bank's 1 Teller money module 5 are essentially identical to the 
similarly named components and application functions described above. 

so 

Money Generator Module 

Figure 6 is a block diagram illustrating the application functions of a Money Generator module 6. Money Generator 
modules 6 provide the mechanism that Issuing Banks 1 utilize to issue electronic money. A Money Generator module 
55 6 is also encased in a tamper-resistant package for the same security reasons stated above for other money modules. 

A Money Generator module 6 generates the electronic money (in the form of electronic notes 11, to be described 
in further detail below), and distributes them to other money modules through the Teller money module 5 of an Issuing 
Bank 1. The Money Generator module 6 includes a unique application not present in other money modules for re- 
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(3) Manage Network Sign-on 58 - controls the money module Network sign-on process; 

(4) Synchronized Time/Date 59 - keeps money module Clock/Timer 43 services synchronized to a system time; 

(5) Route Message 60 - directory services for routing messages, controlling message routing during sign-on and 
during a money module session; and 

5 (6) Direct to Bank Services 61 • provides information on services provided by participating banks. 

As will be appreciated by one skilled in the art, switching and processing centers that are known in the industry 
may be used to enable the networkfrig cooperation between a financial institution and any other that is coupled to the 
same centers. 

10 

Electronic notes 

We turn now to a further description of the elements of the electronic notes 11 themselves. 

An electronic currency note 11 representing value is essentially an electronic object created from a transaction 
is request (deposit or withdrawal) which is backed by demand deposits at an Issuing Bank 1. At various times and in 
various ports of the system, the notes may appear in electrical or magnetic forms or as electromagnetic radiation. 
These notes 11 may be transferred over several transactions just like paper money, with the additional property of 
fungibility that allows the electronic notes 11 to be commuted and transferred in amounts less than or equal to the 
value of the note 11. 

20 Notes 11 may be split by appending a transfer record to the note 11 and signing the note 11 using the private 

cryptographic key of the money module transferring the note 11. Electronic credit notes 11. however, can only be 

transferred once in the preferred embodiment, because it is anticipated that its receiver must deposit the credit note 

11 so that the loan may be realized. 

Credit notes 11, unlike currency notes 11 are drawn on a subscriber's loan account. Each credit note 11 carries 
25 the account number it is drawn on. The account may be a revolving credit or credit line on which the note 11 is drawn, 

operating much in the same way that a check or a credit card account works in toda/s banking industry. Credit notes 

11 can represent a part of or all of the credit line of the account 

In the preferred embodiment, the credit notes 11 can only be transferred to another Transaction money module 4 ' 

by the owner of the account, and the receiver of a credit note 11 can only deposit it into his or her account as currency. 
30 From there, the credit note 11 is cleared with the currency at the Clearing Bank 3. The subscriber's bank recognizes 

the loan upon receipt of the cleared credit note 11. [ 
When credit notes 1 1 are withdrawn, they do not trigger any accounting transactions in the preferred embodiment. ( 

Current credit line processing may need to be modified to keep track of the amount of the credit line in the subscriber's 

Transaction money module 4. Whenever the subscriber communicates with the Issuing Bank 1 maintaining the credit 
35 line, the amount of the credit line in the Transaction money module 4 is removedand replaced based on any adjustments 

to the credit line in the banking system 20. Total credit notes 11 plus outstanding loans must be less than or equal to 

the total amount of the credit line. 

Electronic notes 11 are comprised of three collections of data fields, namely a Body group, a Transfer group, and 
a Signatures and Certificate group. The Body group of data fields includes the following information: 

40 

(1) the type of electronic note 11, La. whether it is a currency note 11 or a credit note 11; 

(2) the Issuing Bank's 1 identifier; 

(3) the monetary unit identifier; 

(4) a Note identifier; 
45 (5) its date-of-issue; . 

(6) its date-of-expiration; 

(7) the subscriber's account number (used only for credit notes 11); 

(8) the amount or value of the note 11 ; and 
(g) the Money Generator module 6 identifier. 

so 

The Transfer group of data fields includes: 

(1 ) a total of the number of times that the electronic note 1 1 was transferred; (provided for currency notes 1 1 only) 

(2) a list of transfer records that indicate the date-of-transf er, the amount transferred and the identification number 
55 of the receiver. 

The Signature and Certificates group of data fields includes: 
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modules 4 access the Certification Agency 28 on a periodic basis to obtain the latest list. Placing a time limit on the 
Transaction money module's 4 ability to transact (in addition to the time limit placed on electronic notes 11) will force 
subscribers to access the Certification Agency 28 through the Network 25 on a periodic basis to receive the latest bad 
money module list along with a new certificate. Advantageously, the period of the certificate validity can be closely 
5 monitored and adjusted according to security needs. 

The Certification Agency 28 distributes its updated certificatory key and money module certificates on-line through 
the Security Server 27 (see Figure 9). An important component of the system's security is provided by Security Servers 
27 at the participating banks and Security Servers 27 at the Certification Agency 28. 

Referring now to Figure 10, a block diagram of a preferred embodiment of the Security Server 27 is shown. It is 
10 contemplated that the Security Server 27 at the Certification Agency 28 or on a bank's local network 18 will contain 
the following application lunctions: 

(1) External Interface 54 - a communications layer for connecting to a bank's local network 18 or the Certification 
Agency's local network 17; 
is (2) Session Manager 55 - controls the security aspects of a transaction session; 

(3) Create Certificate 60 - certifies a certificate for any of the money modules; 

(4) Create Account Profile 51 - certifies and signs a bank account profile (described in detail hereinafter) that allows 
a Transaction money module 4 to access the subscriber's different bank accounts; 

(5) Distribute Certification Keys 52 -distributes the Certification Agency's 28 list of valid public keys to the money 
20 modules; 

(6) Bad Money Module Control 53 - controls and distributes the list of bad money modules; and 

(7) Services - identical to the cryptographic functions 44, 45, 46 in the money modules described above 

Since certificates will expire over time, money modules will be required to apply for new certificates periodically. 
25 in order to receive a new certificate, the money module creates a new public key and private key. The new public key, 
the money module identifier and the old certificate are presented to the Certification Agency 28 after being digitally 
signed using the old private key. 

The Certification Agency 28 checks the signature and it it is valid, signs the new public key and identifier and sends 
the certificate to the money module with a future expiration date. The Certification Agency's 28 Security Server 27 also 
30 distributes a list of bad money modules via the Network 25. Initially, each participating bank's Security Server 27 reports 
the Identifiers of money modules which hold notes 11 invalidly or that are counterfeit. Those identifiers are passed 
through the Security Servers 27 and are compiled by the Certification Agency 28. 

All such identifiers are distributed to the Teller and Money Generator modules S, 6 respectively. A money module 
will not transact with another money module found on the list of bad money modules. Optionally, only those money 
35 modules which have demonstrated a flagrant breach of security will be distributed to Transaction money modules 4. 

If a Transaction money module 4 is lost or stolen, the subscriber would report it to his/her bank or to the Certification 
Agency 28 so that the money module identifier may be placed on the bad money module list to inhibit any further 
transactions. 

While the security of the system is provided by being able to block a money module from transacting, system 
40 security is also maintained by providing the expiration date on the electronic notes 11 in addition to the money module 
certificates. 

As mentioned previously, a note 11 will be valid only tor a limited time period after it is generated. Its date-of- 
expiration is a security parameter which may also be monitored and varied as needed. The period of validity of a note 
11 can be varied by the value of the note 11. Preferably, a large note 11 will expire in a shorter time period than a 
<5 smaller one. For example, a $1 ,000,000 note may be set to expire five days after the date of its creation since it would 
provide a significant incentive to counterfeit, while a $50 note 11 may be set to expire after a month from the date of 
its creation. 

A Transaction money module 4 will not accept expired notes 11 , but can deposit or exchange the notes 11 it may 
contain for new notes 11. The expiration dates are checked by the Verifier 42 and Clock/Timer 43 applications in a 
50 money module before any electronic note 11 is transferred. Separately. It is also anticipated that if the money module 
loses power then it will not be able to pay or exchange notes 1 1 after power has been regained until it has communicated 
again with the Network 25 and had its security parameters updated. 

As stated above, a subscriber will typically obtain a Transaction money module 4 already loaded with a certificate. 
Securing the Transaction money module 4 itself to a subscriber may be accomplished by assigning it a unique PIN, 
55 biometrics or other personal secret characteristics. 

Before any personalization of the money module 4 may proceed, the Transaction money module 4 checks if there 
is a bank account already stored In the To Teller 34 application or if the Notes 40 application contains any electronic 
notes 11 . In either of these cases, the Transaction money module 4 will inhibit the subscriber from securing the module 
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at a branch, or over the telephone utilizing a special dialogue. For example, the subscriber may identify himself by his 
PAN and PIN. He may then enter each account number he wishes to access from his Transaction money module 4. 
The account numbers may be verified in the bank's account reference files. A cross-reference of accounts to Trans- 
action money modules 4 may be maintained by each bank if they so choose. 
5 The composition of an exemplary account profile may be: 

(1) Bank identifier - one for each bank; 

(2) Account Numbers; 

(3) Account Types « e.g., checking, savings, credit; and 
10 (4) Security Server's 27 signature on the list of accounts. 

It wiil be understood that the list of account numbers will be digitally signed by the bank Security Server 27. As a 
further security measure the account profile may be re-signed with an updated public key on a periodic basis. The 
fundamental access security Is provided by thd digital signature of the bank's Security Server 27. 

TS 

Banking System i Accounting Architecture) 

It is a notable feature of the preferred embodiment, that the method of the system can parallel the existing and 
varying types of accounting methods that exist today. The system of the preferred embodiment follows the various 
20 types of accounting methods practiced presently in various banks. However, it is important to note that unlike the 
present banking system, in the preferred embodiment of the invention, economic value is created on demand. Thus, 
there is no inventory of cash or checks involved; electronic currency from demand deposits and electronic credit are 
created on a real-time basis. This elimination of a paper inventory by using an electronic media of exchange requires 
certain supplements to the commonly practiced accounting techniques to provide the reaMime accounting needed. 
2$ Accordingly, the embodiment of the present invention provides an accounting structure to supplement those used 
in the present banking systems 20. The improved accounting arrangement may be utilized to monitor the electronic 
money and each bank's obligation when a financial transaction between a Transaction money module 4 and a Teller 
money module 5 occurs, or when a Clearing Bank 3 performs any clearing processes. 

When electronic notes 1 1 are transferred to or from a Teller money module 5, in most cases accounting transactions 
30 affecting the records of the banking system 20 are created. Conversely, transfers between Transaction money modules 
4 do not involve any formal accounting procedures they Involve only the transfer of electronic notes 11. 

In the system being described, it Is anticipated that the following arrangements of accounts are to be utilized for 
each type of bank, categorized under each monetary unit 
At an Issuing Bankl- 

35 

(1) Money Issued Account: A liability account which reflects the money issued but not cleared. 

(2) Money Due Account: An asset account reflecting the money deposited to the bank's accounts. 

(3) Deposited at Clearing Bank Account: An asset account reflecting the balance of a clearing account at a Clearing 
Bank 3. 

40 (4) Correspondent Bank Money Account: A liability account owned by a Correspondent Bank 2 which is drawn 
upon by the Correspondent Bank 2 to dispense electronic money. 

(5) Money In Transit Account A zero-balance liability account owned by each bank, which is used to temporarily 
maintain electronic money during a financial transaction. 

(6) Foreign Exchange Account: A zero-balance liability account owned by each bank, which is used to handle 
45 rn ultiple currency exchanges. 

At a Correspondent Bank 2 - 

(1) Deposited at Issuing Bank Account: An asset account reflecting the balance of the Correspondent Bank 2 
50 account at the Issuing Bank 1. 

(2) Money Due Account: An asset account reflecting the money deposited to the bank's accounts. 

(3) Foreign Exchange Account: A zero-balance liability account owned by each bank, which is used to handle 
multiple currency exchanges. 

(4) Money In Transit Account A zero-balance liability account owned by each bank, which is used to temporarily 
ss maintain electronic money during a financial transaction. 

At the Clearing Bank 3: 
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Alternatively, if a subscriber begins with $50 in his/her Transaction money module 4 and deposits all of it, the 
customer account would be credited $50 and the Money Due account would be debited by $50 (Step 1 of Figure 11; 
parenthetical entries). 

When there are only $50 of electronic noles 11 that are removed, the Correspondent Bank 2 credits the Money 
5 Due account $50 and the Deposited at Issuing Bank account is debited $50 (Step 2, parenthetical entries). This money 
Is then deposited at the Issuing Bank 1 for later clearing, wherein the Correspondent Bank Money account is credited 
by $50 and the Money Due account is debited by $50. Because no updated electronic notes 11 need be returned in 
this situation, the deposit and its corresponding accounting is completed at Step 2. 

The accounting processes of an electronic money deposit at an Issuing Bank 1 instead of a Correspondent Bank 
10 involve fewer operational steps, which are illustrated in Figure 12. Using the same dollar amounts as in the previous 
exemplary transaction, when $50 of $100 in electronic money stored in the Transact ton money module 4 are deposited 
directly to an Issuing Teller money module (Step 1 ), $50 would be credited to the customers account (A). Fifty dollars 
would simultaneously be credited to the Money In Transit account, and $100 would be debled to the Money Due 
account at the Issuing Bank 1. 

*s Since the entire $1 00 stored in the Transaction money module 4 Is removed and transferred to the Issuing Bank's 
Teller money module 5, it is necessary to return $50 of updated notes to the Transaction money module 4. Accordingly, 
as shown in Step 2 the Teller money module 5 requests $50 from its Money Generator module 6, debiting its Money 
In Transit account by $50 and crediting its Money Issued account by $50. 

In response. $50 is created by the Money Generator module 6 and transf e rred to the Teller money module 5, which 
20 in turn transfers this electronic money to the Transaction money module 4 (Step 3-4). 

When only $50 is stored in the Transaction money module 4 and all of it is deposited, the customer's account (A) 
Is credited $50, the Money Due account Is credited $50, and that is the end of it. See parenthetical entries in Step 2 
in Figure 12. 

In the case of a withdrawal from a Correspondent Bank (see Figure 13), a withdrawal request of $100 by a sub- 
25 scriber using a Transaction money module 4 at a Correspondent Bank 2 will cause the subscriber's account (A) to be 
debited by $1 00 and the Correspondent Bank's 2 Money In Transit account to be credited by $1 00 (Step 1 ). The request 
for the $100 withdrawal is forwarded to the Issuing Bank 1 from the Correspondent Bank 2, and the Correspondent 
Bank's Deposited at Issuing Bank account is credited by $100 while its Money In Transit account is debited by $100 
(Step 3). 

30 Next, the request for $100 is forwarded by the Issuing Bank's 1 Teller money module 5 to the Money Generator 

module 6. Accordingly, the Correspondent Bank Money account gets a $100 debit while the Money Issued account 
gets a $100 credit (Step 4). 

The Money Generator module 6 then creates the $100 of electronic notes 11, and transfers it to the Transaction 
money module 4 via the Issuing Bank's 1 Teller money module 5 and the Correspondent Bank's 2 Teller money module 
35 5 (Steps 5-6). 

When, e.g., the subscriber makes the $100 withdrawal request with a Transaction Money Module 4 that contains 
$50 of electronic notes 11, the notes 11 are removed and now the Money Due account is debited $50, the subscriber's 
account is still debited $100, and the Money In Transit account is credited $150 (parenthetical entries, Step 1). 

The $50 is then deposited to an Issuing Bank 1, causing the Money Due account to be credited $50 and the 
40 Deposited at Issuing Bank account to be debited by $50. At the Issuing Bank 1 , the Correspondent Bank Money account 
is credited $50 while the Money Due account is debited $50 (Step 2, parenthetical entries). 

Because $50 of notes 11 have been removed, the withdrawal request in Step 3 must be for $150. This request 
causes the Deposited at Issuing Bank account to be credited by $150 and the Money In Transit account to be debited 
by $150 (Step 3 parenthetical entries). 

At the Issuing Bank $150 is requested from the Money Generator Module 6 and the Correspondent Bank Money 
account gets a $1 50 debit while the Money Issued account gets a $1 50 credit (Step 4 parenthetical entries). As above, 
the money generated by the Money Generator Module 6 ($150) gets conveyed to the Transaction money module 4 
via the Issuing Bank 1 and Correspondent Bank 2 Teller money modules 5 (Steps 5-6, parenthetical entries). 

A withdrawal from an Issuing Bank 1 involves fewer accounting procedures. Referring now to Figure 14, a with- 
50 drawal request by a Transaction money module 4 from an Issuing Bank 1 . Step 1 will cause the Issuing Bank 1 Teller 
money module 5 to debit the subscriber's account (A) by $1 00 and credit its Money Issued account by $1 00 (Step 1 -2). 

A request for an updated $1 00 is then made by the Issuing Bank's 1 Teller money module 5 to the Money Generator 
module 6, which upon its creation will return $100 to the Issuing Bank's Teller money module 5 (Step 3). In completing 
the transaction, the Issuing Bank's 1 Teller money module 5 simply transfers this $100 containing the most recent 
55 certificate to the Transaction money module 4 (Step 4). 

Alternatively, when the Transaction money module contains $50 at the time of the $100 withdrawal, (parenthetical 
entries) the $50 will be removed, the Issuing Bank's Money In Transit account will be credited $50 and the Money Due 
account will be debited $50 (Step 1 ). 
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by $50. Since no notes 11 are removed, no accounting is performed in Step 2. 

In Step 3, only $50 is requested from the Money Generator module 6. and the Money In Transit account is debited 
by $50 while the Money Issued account is credited by $50. The same transfer between money modules occurs as in 
Steps 4-5 of Fig. 19 described above, using only the $50 that was requested. This would leave the subscriber with $50 
5 of electronic notes 1 1 in lieu of his original $50 of paper money. 

In Fig. 20, an exchange of cash for electronic notes 11 at a Correspondent Bank 2 is shown. This example uses 
the same parameters as in Figure 19. namely, the subscriber has $50 of cash and $100 of electronic notes 11 In his 
Transaction money module 4. 

When the $50 in cash is deposited to the Correspondent Bank 2, its Money In Transit account is credited $50 while 
ro its Cash account is debited $50 (Step 1). The $100 of electronic notes 11 is then transferred from the Transaction 
money module 4 to the Correspondent Bank 2 which credits its Money In Transit account by $100 and debits its Money 
Due account by $1 00 (Step 2). 

From there, the $100 of electronic notes 11 is deposited at the Issuing Bank 1, wherein its Money Due account Is 
debited by $100 while its Correspondent Bank Money account is credited by $1 00 (Step 3). At the Correspondent Bank 
is 2, the Deposited at Issuing Bank account is debited by $100 while the Money Due account is credited by $100. 

A withdrawal request is then made by the Correspondent Bank 2 for $1 50 from the Issuing Bank 1 (Step 4). This 
request results in the Correspondent Bank 2 debiting its Money In Transit account by $1 50 and crediting its Deposited 
at issuing Bank account by $150. 

Correspondingly, the Issuing Bank 1 Teller money module 5 requests $150 of notes 11 from the Money Generator 
20 Module 6, debits its Correspondent Bank Money account by $1 50 and credits its Money Issued account by $1 50 (Step 
5). 

Finally, the $150 of electronic notes 11 Is transferred from the Money Generator module 6 to the Issuing Bank's 1 
Teller money module 5 which transfers it to the Transaction money module 4 after passing through the Correspondent 
Bank's 2 Teller money module 5 (Steps 6-8). 
25 Alternatively, a subscriber having only $50 of cash and no notes 1 1 in his/her Transaction money module 4 is also 

shown in Fig. 20. As in the first case, the $50 in cash is deposited to the Correspondent Bank 2, its Money In Transit 
account is credited $50 while its Cash account is debited $50 (Step 1). 

A $50 withdrawal request is then made to the Issuing Bank 1 , and the Money In Transit account is debited by $50 
while the Deposited at Issuing Bank account is credited $50 (Step 4, parenthetical entry). Thereafter, $50 is requested 
30 from the Money Generator Module 8, the Correspondent Bank Money account is debited $50 and the money issued 
account is credited $50 in Step 5 (parenthetical entry). Here, $50 in electronic notes 11 are transferred through the 
same money module path as Steps 6-8 above, to reach the Transaction money module 4. 

Figure 21 illustrates the exchange of electronic notes 11 for cash at an Issuing Bank 1. Here the subscriber has 
$100 of electronic notes 11 stored in his/her Transaction money module 4 and wishes to exchange $50 of the electronic 
ss notes 11 for $50 of paper cash. 

After the Transaction money modufe 4 establishes the communications with the Issuing Bank's 1 Teller money 
module 5, all $100 of the electronic notes 11 is removed from the Transaction money module 4 (Step 1 ). This causes 
the Money In Transit account to be credited by $100 and the Money Due account (at the Issuing Bank 1 ) to be debited 
by $100. 

40 The Teller money module 5 then requests $50 of updated electronic notes 11 from the Money Generator module 

6, and this transaction requires the Money In Transit account to be debited by $50 and the Money Issued account to 
be credited by $50 (Step 2). The newly generated $50 of electronic notes 11 is then transferred to the Transactbn 
money module 4 through the Teller money module 5. The $50 of paper cash is then transferred to the subscriber 
through a Teller or ATM (Steps 3-5). 

<s Also shown in this figure (parenthetically) is the subscrtoer making the same exchange for cash when only $50 is 

stored in his/her Transaction Money Module 4. At the Issuing Bank. $50 of electronic notes 11 is removed for which 
the Money In Transit account is credited $50 and the Money Due account is debited $50. Fifty dollars of paper cash 
is then returned to the subscriber since he/she only deposited $50 of electronic notes 11 (Step 5). 

Completing this transactbn, in both cases the Money In Transit account is debited by $50 while the cash account 

so at the Issuing Bank 1 is credited by $50. The net result Is that the subscriber ends up with $50 of paper cash and, in 
the former case only, $50 of updated electronic notes 11 in his/her Transaction money module 4. 

The exchange of electronic notes 11 for paper cash at a Correspondent Bank 2 is illustrated in Figure 22. As in 
the example illustrated in Figure 21 . although the subscriber is only exchanging $50 of electronic notes 11 , all $100 of 
electronic notes 11 are transferred from the subscriber's Transaction money module 4 (Step 1). 

55 After the notes 1 1 are transferred, the Correspondent Bank's 2 Teller money module 5 credits its Money In Transit 

account by $100 and debits its Money Due account by $100. This $100 of electronic notes 11 is now deposited at an 
Issuing Bank 1 , causing the Correspondent Bank 2 to credit its Money Due account by $100 while debiting its Deposited 
at Issuing Bank account by $100 (Step 2). 
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Bank 3. 

The Clearing Bank 3 may be implemented in any computer processing facility capable of accommodating the large 
number of transactions and corresponding amounts ot data which the system will typically handle. A high volume 
mainframe compute r, a su ilably siz ed minicomputer system, a number ol networked work stations having the necessary 

5 data processing capabilities or combination o( the foregoing may also be used. As will be appreciated by a person 
skilled in the art, the particular design of the Clearing Bank 3 hardware system Is not critical to the invention. 

It is anticipated that Issuing Banks 1 may clear money in one of several procedures. In one of these procedures, 
electronic money may be deposited on-line from the Issuing Bank 1 to the Clearing Bank 3. This could be done on- 
line in a real-time mode when transactions are actually occurring. Alternatively, an Issuing Bank 1 may record the 

io details of transactions being performed during the course of the day for later batch processing. Interbank processing 
could occur several times a day. 

As shown in Figure 26, an Issuing Bank 1 may periodically transfer its electronic money to a deposit consolidation 
file (consolidate deposits) which may be processed and transmitted to the Clearing Bank 3. Transaction records from 
this file are also conveyed to the bank's Transaction Reconciliation system 22 for statistical and housekeeping functions. 

rs At the Clearing Bank 3, the deposit consolidation files are processed creating a single debit and credit by the 
monetary unit for each Issuing Bank's 1 demand account Of course, the appropriate accounting transactions lor these 
demand accounts are posted during the clearing processes. Any accounts which are overdrawn will be settled via the 
usual interbank settlement processes that are commonly used in the industry. 

The processed electronic money that is cleared is sent back to the Money Issued Reconciliation System 23 of 

20 each of the banks that issued it in order to be reconciled and checked for tampering and duplication. 

Additional statistical and housekeeping functions are implemented in the Money Issued Reconciliation System23, 
as shown in Figure 27. Issuing Bank's 1 provide their own Money Issued Reconciliation System 23, typically embodied 
in a general purpose computer but not so limited, for matching the electronic money issued to the electronic money 
cleared at the Clearing Bank 3. 

25 As indicated in Figure 27. the electronic money issued and electronic money deposited at Issuing Banks 1, and 
money cleared transactions received from clearing bank 3 are conveyed to the Money Issued Reconciliation system 
23. The Money Issued Reconciliation system 23 generates accounting transactions for the money cleared, and updates 
a master file of all the bank's money issued. Additionally, the Money Issued Reconciliation system 23 passes to an 
investigation subsystem 13 money which has cleared but which was not issued or was possibly transferred more than 

30 once. 

Any unmatched cases may indicate a potential breach of security. Investigators may then determine whether Money 
Generator modules 6 are not working property or money modules are being tampered with. Money module identifiers 
of faulty or abused money modules are passed to each bank's Security Servers 27 for distribution to the other money 
modules on the bank's local network 18. The identifiers are also sent to the Certification Agency 28 for appropriate 

35 distribution throughout the Network 25. 

Separately, the Money Issued master file is accessed by the Money Position system 24 which creates a file to be 
transmitted to the Clearing Bank 3 to create a consolidated money position. It is contemplated that all Issuing Banks 
1 will provide a report reflecting their position at the end of a specified period, typically at the end of every day. The 
Money Position System 24 may consolidate these reports to reflect the amount of money issued by the Issuing Banks 

40 i for each monetary unit. The reports will reflect the outstanding position ot each Issuing Bank 1 in order to assess the 
risk of interbank settlement problems. 

Operational Sequences 

45 Although some aspects of the preferred embodiment may be described in terms of detailed schematic diagrams, 
the transaction functions are best illustrated by use of process flowcharts. Thus, to facilitate understanding of the 
operation of the money modules, several examples of transactions are set forth in the flowcharts of Figures 28-50A. 
Referring to these figures, a detailed description of the system processes and the associated application functions that 
incorporate the principles of the preferred embodiment of the present invention will now be described. 

so Throughout the descriptions of the flowcharts (except where indicated otherwise), the application functions of the 
Transaction money module 4, whether they are imbedded in a hand-held unit or other type of processing device, are 
hereinafter designated with the suffix "A', and the Teller money module 5 applications and its associated bank are 
hereinafter designated with the suffix "BV In the case where a Correspondent Bank 2 interacts with an Issuing Bank 
1, the Issuing or Correspondent Bank 1 and its associated Teller money module 5 applications are hereinafter desig- 

55 nated with a P C\ 

Additionally, transitions to steps in another figure are indicated by a pentagonal tag having an alphanumeric symbol, 
and continue on the other figure with a circle having the same alphanumeric symbol therein. 
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modules 4,5.6 of the present embodiment. Thus, in this example. "A" denotes any class ot money module. 

After the bank that is to be accessed is selected, the money module initiates communication with the Network 25 
under the control of its Session Manager A 31 (Step 50). The Network Server 26 begins by requesting the certificate 
ot the Transaction money module 4 from Session Manager A 31 (Step 52-54). The Maintain Security A application 37 
5 retrieves and sends the certificate to Session Manager A 31 (Step 56). Session Manager A 31 sends the certificate to 
the Network Server 26 (Step 58). which, upon receipt, routes ft to the Security Server 27 (Step 60). 

The Security Server 27 tests the certificate to check its validity (Step 62-64). and if it is not valid tor any reason, 
the Security Server 27 wilt signal the Network Server 26 to deny access (Step 66). The Network Server 26 may in turn 
convey an access-denied message to Session Manager A of the Transaction money module 4 (Step 68-70). 
10 If the Session Manager A that receives the denied access message is a Transaction money module 4, its To 

Subscriber application A will inform the subscriber of this condition (Step 74). if it is a Teller money module 5 or Money 
Generator Module 6 that is trying to access the Network 25. the To Bank A application 47 notifies the bank's systems 
20 that its access will not be permitted (Step 76). 

Assuming the certificate validity check Is satisfied, the Security Server 27 sends an updated list of the bad money 
75 modules, and a new list of certificatory keys to the Session Manager A, (Step 78, Fig. 33A). The keys are signed using 
the last version of the certificatory key. This information is received by Session Manager A and forwarded to the Maintain 
Security A 37 application, which will validate the certificatory key fist and the bad money module list (Steps 80-82. Fig. 
33A). 

Public Key A 44 tests the validity of the signature (Step 84) and if the signature is not valid, a message warning 
?o of a network security problem is sent by the To Subscriber application A 33 of a Transaction money module 4 (Steps 
86-90), or alternatively, by the To Bank application A application of a Teller money module 5, (Steps 86-88, 92). Ad- 
vantageously, all money modules will check the validity of a signature received from even the Security Server 27. This 
helps to ensure the integrity of the overall system. 

In the case of a valid signature, Maintain Security A updates the bad money module list and the certificatory key 
25 list. (Step 94). If the certificate is to be recertified or the certificate ha6 expired (Steps 96 and 98). the Maintain Security 
A generates a new certificate (Step 1 26 of Figure 33C) while Public Key A generates new keys and signs the certificate 
using the old public key (Step 1 28). Session Manager A sends the new certificate to the Security Server 27 who takes 
the certificate and tests the validity of the signature (Steps 130-136). 

Assuming that the signature of the new certificate is not valid at this stage, Steps 66-76, Fig. 33, are repeated so 
30 as to terminate the communication link into the Network 25. 

On the other hand, a valid signature, Fig. 33C, will allow the Security Server 27 to sign the new certificate and 
send it back to the money module (Step 1 38). Session Manager A 31 receives the new certificate, Step 140, Fig. 33D, 
and forwards it to its Maintain Security application A to again validate the certificate through use of the Public Key 
application (Steps 142-146). Here, the money modules will repeat the test of the validity of the certificate issued from 
35 the Security Server 27. For a valid signature, the Session Manager A 31 sends an acknowledgment to the Security 
Server 27 (Step 148) who responds by returning the process to Step 78. Fig. 33A. 

Conversely, if the Security Server's signature on the new certificate generated by Transaction money module A 
proves to be invalid, Fig. 33D. Session Manager A will send an invalid certificate message along with the certificate 
back to the Security Server 27 (Step 150), which will again attempt to validate the signature on the certificate (Step 
40 152). A valid signature will return the process to Step 66. Fig. 33. Alternatively, an invalid signature will cause the 
Security Server 27 to disconnect from the Network 25 (Step 156. Fig. 33D) and cause the Network Server 26 to notify 
the money module of a malfunction (Step 1 58). 

The Session Manager A that receives the message (Step 160) will, in the case of a Transaction money module 4, 
get the To Subscriber A 33 to inquire of the subscriber if they desire to retry the whole process of signing on to the 
45 Network 25 (Steps 164 & 168). In the case of a Teller money module 5 or a Money Generator Module 6, the To Bank 
application A will inquire if there is a request to retry the Network 25 sign-on procedure (Steps 166 & 168). 

No attempts for a retry will, of course, end the communication link into the Network 25, and conversely, a request 
for retry of Network 25 access will return the procedure back to Step 56, Fig. 33, wherein Maintain Security A will again 
retrieve the Transaction money module's certificate for the Network Server 26. 
50 Back at Step 98. Fig. 33A if the certificate does not need to be recertified or has not expired, Session Manager A 

31 will request the date and time (Step 100) from Clockffimer A (Step 102, Fig. 33B) t and forward this data to the 
Network Server 26 (Step 1 04). 

The Network Server 26 checks the time and date after receiving it (Step 106) and if it is outside of an acceptable 
predetermined parameter, the Network Server 26 will send the new time and date (Step 1 1 0) to Clock/Timer A through 
55 Session Manager A (Steps 112 & 114). If OockfTimer A 43 cannot adjust the date and time to be synchronized with 
the Network 25, the operator of the money module tor subscriber or the bank is notified of the clock malfunction (Steps 
116-124). 

In response to the apparent malfunction, the operator may attempt to have the time and date resent from the 
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money module involved (Step 512). 

Briefly referring to Figure 37, all encrypted messages between modules will be provided by the following steps. 
The sending money module (here also referred to as "X") uses its Symmetric Key 45 to encode the message to be 
sent to the receiving money module (here also referred to as B Y"). (Step 2). Again, it will be appreciated that there are 
5 a number of known encryption techniques which may be utilized. 

The Session Manager X 31 sends the encoded message to Session Manger Y 31 which in turn decodes the 
message using its Symmetric Key Y 45 (Steps 4-8). 

Continuing with Figure 32, the Session Manager Y responds to the termination notice sent by also undoing any 
changes it may have made towards establishing the session, and noting the aborted session (Steps 514-516). If it is 
10 a Transaction money module 4 that is now shutting down, the To Subscriber application 33 alerts the subscriber of the 
condition (Step 518 & 524). Correspondingly, in a Teller money module 5, the To Bank application 47 will reverse all 
accounting transactions that have been undertaken (Steps 518-522). 

Returning to Figure 34B, assuming that the money module B certificate Is valid, In Step 228 Maintain Security A 
checks to see if money module B is on the fist of compromised money modules. If money module Bison the list (Step 
*s 230), the session reverts to the abort transaction procedure, Steps 500-524. Thereafter, the communications session 
is dissolved. 

More typically, money module B will not be on the list of compromised money modules, and the Clock/Timer A 43 
will retrieve the date and time (Step 232) and send this information to the Maintain Security application A 37 so that 
the verification message may be assembled with the date and time (Step 234). 

20 Symmetric Key A 45 then encrypts the verification message with the date and time information, using the random 

session key provided by money module B (Step 236). Session Manager A 31 sends this encrypted message (Step 
238) to Session Manager B 31 (Step 240). From there, the Symmetric Key application B 45 decrypts the message 
(Step 242) and passes it to the Maintain Security B 37 for message verification (Step 244, Fig. 34C). An incorrect 
message will cause the session to be aborted through Steps 500-524, while a correct message will advance the pro- 

25 cedure so that Maintain Security B 37 can compare the time and date with that of money module A (Step 248). 

CloclvTlmer B 43 witl verify that money module A's clock is within a preset amount of deviation from the clock of 
money module B (Step 250). If the discrepancy between the two clocks is greater than a predetermined amount, the 
session will be aborted by branching to Steps 500-524. 

If there is no discrepancy that is greater than the permissible amount, Sessbn Manager B 31 will note its start of 

30 a session (Step 252), and send an acknowledgement to money module A to start the transaction (Step 254). After the 
encoded message is sent from money module B to Session Manager A 31 using process steps 2-8. Fig. 37, Session 
Manager A 31 acknowledges the message receipt and also notes the start of session (Steps 256-258). 

Request Withdrawal 

35 

After a session is established between the Transaction money module 4 and Teller money module 5, the Trans- 
action money module 4 makes a withdrawal request from the Teller money module 5. See Figure 29. Referring now 
to Figure 30, a process for requesting a withdrawal will now be descrfoed. It should be noted that although the figure 
denotes the parties as "X" and "Y/ in the process steps described below, they are applicable to any money module 

to transacting with a Teller money module 5. 

To begin, the To Teller X 34 sends a withdrawal request to the Teller money module 5, requesting a certain amount 
of money to be withdrawn from a specific account. In its transmission of the withdrawal request, the account number 
and the account profile will be transmitted from the requesting money module to the Teller money module 5 (Step 700). 
To send this request, the process Steps 2-8 are repeated, in which the message is encrypted using the previously 

4$ described cryptographic techniques. 

Validate Account Number 

Once the withdrawal request and the account number and profile are transmitted to the Teller money module 5, a 
so procedure to validate the account number is initiated (Steps 7041-7055). A flow diagram depicting how an account 
number is validated is shown in Figure 38. 

In this process, the Maintain Security application 37 of the Teller money module S receives the account profile and 
signature and conveys them to its Public Key application 44 to verify the profile signature (Steps 7041-7042). The 
signature is tested using the public key generated and distributed by the Bank's Security Server 27. An invalid signature 
55 causes the Maintain Security 37 application to inform the Session Manager that the account profile is invalid (Step 
7044), whereby Steps 500-524, Fig. 32, are followed to abort the transaction between the two money modules. 

If the signature test confirms a valid signature, the procedure advances to the To Bank application 47 which sends 
the account number it has received on to the bank's computer systems (Step 7046). An inactive account will cause 
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Request Notes 

Directing attention to Figure 40, notes 1 1 may be requested between Teller money modules 5 and Money Generator 
modules 6 using the following procedure described below. 

The To Money Generator application 48 of the requesting Teller money module 5 will issue a request for a specific 
amount of electronic money to be created (Step 780). The request wDI be sent using the above described Steps 2-8 
for encrypted transmission, to the To Teller application 34 of the Money G enerator module 6 60 that the Money Creator 
application 50 may be activated (Step 784) to create the electronic notes 11 (Step 786). 

After the creation of electronic notes 11, they are signed by the Public Key application 44 of the Money Generator 
module 6 (Step 788) and placed in a holder by its Notes application 40 (Step 790). Fhally, the Note Directory 39 is 
updated with the information about the newly created electronic notes 11 (Step 792). 

The process flow now returns to the procedures shown in Figure 28. The requested notes in the Money Generator 
module 6 are transferred to the Teller money module B5 using the process Steps 750-770 outlined above for transferring 
electronic notes 11. The notes 11 are then transferred from the Teller money module B 5 to the Transaction money 
module 4 using these same process Steps 750-770 for transferring- electronic notes 11. 

Finally, to successfully complete the withdrawal of electronic notes 11, the money modules will "commit" to or 
finalize the transaction by utilizing the following procedure. Referring now to Figure 41 for a detailed description of this 
process, the Tran Log Mgr. application 36 updates its Tran Log to record the transaction that has occurred above (Step 
690). When it is a Transaction money module 4 that is committing to the exchange (Step 691), the To Subscriber 
application will notify the subscriber that the transaction has been successfully completed (Step 692). Of course, the 
Session Manager application A 31 will note the end of session (Step 693), and employ process Steps 2-8 to send the 
message to the money module it is transacting with. 

With this end of session notice received, the other money module, in this example a Teller money module 5, will 
use its Tran Log Mgr. application 36 to update its own Tran Log (Step 694). Assuming, however, the second money 
module receiving the end of session notice is not a Teller money module 5, an additional step of having the To Subscriber 
application 33 notify the subscriber of the end of the transaction occurrence (Step 696) will be necessary. Thereafter, 
the Session Manager 31 of the second money module in both cases will also make note of the end of the session (Step 
698). 

Directing attention back to Figure 28, the process to commit is initiated first by the Transaction money module 4 
committing its transaction with the Teller money module B 5 (Steps 690-698). The process steps are also applied to 
commit the transaction between Teller money module B 5 and the Money Generator module 6 (Steps 690-698). That 
completes the processing for one complete withdrawal of electronic money from an Issuing Bank 1 . 

Withdrawal From A Correspondent Bank 

35 

A withdrawal from a Correspondent Bank 2 will now be described, aided by reference to Figure 35. To begin, the 
previously described Steps 43-48 to set up a withdrawal are undertaken by a Transaction money module A 4, in con- 
junction with an Teller money module B 5. Next, Steps 1 90-258, used to establish a session, also described above, 
are initiated between Teller money module B 5 and Teller money module C 5. After the sessions have been established, 
40 the To Bank application B 47 will post the accounting transaction corresponding to the withdrawal that is going to 
subsequently occur (Step 900; see also Fig. 1 3, Step 1 ). 

As previously noted, it is contemplated that whenever a Transaction money module 4 interacts with a bank, both 
Issuing 1 and Correspondent 2, all electronic notes 11 that are stored within the Transaction money module 4 are 
removed and replaced with electronic notes 11 containing the most recent certificate. To perform this operation, To 
& Transaction B 49 will check to see if there are notes 1 1 stored within the Transaction money module 4 (Steps 902-904). 
If there are notes 11 , To Bank B 47 will post the appropriate accounting transactions (see accounting procedure illus- 
trated in Figure 1 3; Step 2) (Step 906), and perform a deposit request to the Teller money module C 5 (associated with 
an Issuing Bank 1) to return the notes 11 that need to be replaced 

For a detailed description for performing a deposit request, attention will be directed to Figure 44. Mere, the To 
50 Teller application 34 sends a deposit request message, the amount of the deposit to be sent, the account number and 
the account profile of the account to which the notes 11 will be deposited (Step 920). This information is transferred to 
the Teller money module 5 using Steps 2-8 for sending messages, and then Steps 704t-7050 (see Figure 38) are 
performed to validate the account profile and number. 

In the case where the depositor is a Transaction money module 4, the To Transaction application 49 of the Teller 
55 money module 5 will send an acknowledgement to the Transaction money module 4 that the transfer of notes 11 is 
ready to proceed (Step 924). Alternatively, if it is another Teller money module 5 that is making the deposit, it is the To 
Teller application 34 that issues the acknowledgement to the Teller money module 5 (Step 926). 

In either case, the acknowledgement is encrypted and transmitted using the procedure outlined in Steps 2-8, 
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The To Teller A 34 receives the acknowledgement (Step 430) and initiates the Steps 690-698 to commit the deposit 
transaction between the two money modules. 

When the electronic notes 11 removed exceed the desired deposit amount, new updated notes 11 must be returned 
to the Transaction money module 4. To perform this, the To Bank application B 47 of the Teller money module B 5 
posts the proper accounting transactions (Step 424; Fig. 12, Step 2). Thereafter. Teller money module B 5 establishes 
a session with the Money Generator module 6 using process Steps 190-258, and requests electronic notes 11 from 
the Money Q enerator module 6 in the amount that should be returned to the Transaction money module 4, by performing 
Steps 780-792. 

The electronic notes 11 are created by the Money Generator module 6 and transferred to the Teller money module 
B 5 using Steps 750-770. With the electronic notes 11 in the possession of the Teller money module B S, they are 
transferred to the Transaction money module A 4 using Steps 750-770. 

After Transaction money module A 4 receives the electronic notes 11 , it must finalize the transaction by committing 
Teller money module B 5 to Transaction money module A 4 using Steps 690*698. Likewise, Teller money module B 5 
must commit to the Money Generator module 6 using the same Steps 690-698. 

Deposit To A Correspondent Bank 

Figure 45 illustrates the process flow for a deposit at a Correspondent Bank. In depositing to a Correspondent 
Bank 2, the deposit set up described in Steps 398 through 41 4 are repeated in the first stage of the transaction. From 
20 there the To Transaction B 49 tests to see if the deposit is less than the total amount of electronic notes 1 1 that have 
been withdrawn in the deposit set up procedures that were just processed (Step 440). 

In the case where all the electronic notes 11 stored in the Transaction money module 4 are equal to the amount 
of notes 11 to be deposited, then To Transaction B 49 sends a deposit acknowledgement back to the Transaction 
money module 4 (Step 444), using Steps 2-8 to send the message from the Teller money module B 5 to Transaction 
25 money module A 4. 

On the Transaction money module 4 side, the To Teller 34 application receives the acknowledgement (Step 446) 
and uses Steps 690-698 to commit the transaction with Teller money module B 5. The Transaction money module 4 
is now finished and removed from the process. The finalization of the deposit provides for the account posting trans- 
actions to be made by the To Bank application 47 (Step 448). See Figure 11 , Step 1 for the accounting transactions. 
30 A session is now established between the Teller money module B 5 and Teller money module C 5 using Steps 

190-258. 

Teller money module B 5 issues a request to make a deposit to the Teller money module C 5 by using process 
Steps 780-792. The To Bank B 47 then posts the accounting transactions (Step 450; see atso Fig. 11, Step 2). 

Notes 11 are now transferred from the Correspondent Bank B 2 to the Issuing Bank C 1 using Steps 750-770; the 
3$ Issuing Bank C 1 posts the corresponding accounting transactions (Step 452; see also Fig. 11 , Step 2). The To Teller 
C 34 responds by sending the deposit acknowledgement (Step 454) using Steps 2-8, to To Teller application 34 of 
Teller money module B 5 (Fig. 45A, Step 456). 

Here again, the deposit is checked to see if it is less than the amount of electronic notes 1 1 that have been removed 
earlier, and when it is not, the withdrawal is completed with the process Steps 690-698, Fig. 41 , to commit Teller money 
40 module B 5 to Teller money module C 6. 

A deposit request that is less than the amount of notes 11 that are withdrawn requires account updating (Step 460; 
see also Fig. 11 , Step 3), and new notes 11 to replace the additional notes 11 that were taken. Accordingly, a withdrawal 
request following the process Steps of 700-724 from Teller money module B 5 to Teller money module C 6 is made to 
provide these new electronic notes 11. 
4S Teller money module C 5 must first establish a session with the Money Generator module 6, using the process 

Steps 190-258. The new electronic notes 11 are requested by the Teller money module C 5 from the Money Generator 
module 6 following process Steps 780-792, which are then transferred to the Teller money module C 5 using Steps 
750-770 to transfer notes 11 between money modules. 

This transfer of electronic notes 11 to the Teller money module C 5 requires that accounting transactions be posted 
so by the To Bank application C 47 (Step 462, Fig. 45B; see also Fig. 11, Step 3). 

From there, the notes 11 are transferred from the Issuing Bank's 1 Teller money module C 5 to the Correspondent 
Bank's 2 Teller money module B 5 and to the Transaction money module 4 by using Steps 750-770 for transferring 
notes 11 . Thereafter, each money module must commit to the money module with which it has established a session. 
Thus, Transaction money module A 4 commits to Teller money module B 5, Teller money module B 5 subsequently 
ss commits to Teller money module C 5, which then commits to the Money Generator module 6. Ail three of these com- 
mitment transactions use process Steps 690-698 above. 
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dissolved using abort transaction Steps 500-524. 

When the funds are sufficient to meet the amount requested, the Pay/Exchange A 35 sends the amount of the 
dollars and the proposed dollar/pound exchange rate (Step 316) to the To Subscriber application 33 of Transaction 
money module B 4 using the Steps 2-8. (See Figure 46A). At this point, To Subscriber B 33 prompts Bob with the 
5 amount and rate proposed by Alice, to determine If the values are what Bob wlO agree to exchange (Step 322). 

The Pay/Exchange B 35 receives the dollar amount and the rate that is proposed by Alice and if the amount and 
rate are not agreed to by Bob, Pay/Exchange B 35 will send a message indicating that the value or exchange rate is 
incorrect (Step 326), through the Steps of 2-8 for sending messages. To Subscriber A 33 prompts Alice for the dollar 
amount and exchange rate over again (Step 327). Entry of new values returns the process to Step 31 0 for continuation, 
10 see Fig. 46, while the lack of new values entered causes the abort transaction process of Steps 500-524 to be initiated. 

If the amount and rate are agreed to by Bob. Pay/Exchange B 35 will calculate the equivalent amount in pounds, 
based on the rate provided (not shown), and then initiate the step of having Note Directory B 39 check to see that 
Transaction money module B 4 contains sufficient funds to fulfill the exchange (Step 323). When the funds In Trans- 
action money module B 4 are insufficient to meet the exchange, Pay/Exchange B 35 sends a message to Alice of 
is insufficient funds (Step 325) using Steps 2-8. The process flow returns to Step 327. 

Proceeding with the case in which sufficient funds do exist h Transaction money module B 4, Pay/Exchange B 35 
will send an acknowledgement using Steps 2-8 to Transaction money module A 4 (Step 329). After receiving this 
acknowledgement, Pay/Exchange A 35 sends the amount of dollars requested to its corresponding Money Holder 38 
application in Step 330. The dollars are transferred from Alice to Bob via the Steps 750-770 described above for 
20 transferring notes 11. 

Pay/Exchange B 35 receives the notes 11 and then transfers the amount of pounds to its Money Holder 38 appli- 
cation (Step 331 ). From there, the electronic pounds are transferred to Alice using the transfer notes process described 
In Steps 750-770. To record this exchange, Transaction money module A 4 commits with Transaction money module 
B 4 by using process Steps 690-698 described above. With a satisfactory exchange, the communications link between 
2S the two Transaction money modules may now be terminated. 

Foreign Exchange At An Issuing Bank 

Turning attention now to Figure 48, if a subscriber were to exchange his/her dollars for pounds with an Issuing 

30 Bank 1 instead of with a subscriber, the following process is followed. 

Subscriber A sets up the foreign exchange transaction by signing on to his/her Transaction money module 4 (see 
Fig. 472) using Steps 10-42 described above. To Subscriber A 33 prompts the subscriber for the transaction desired 
(Step 334), and in this example, the subscriber chooses the dollar/pound exchange, and the amount of dollars the 
subscriber will exchange. It is anticipated that the choice of the bank to transact with may be an option offered to the 

3$ subscriber.(Step 336). 

The Note Directory A 39 checks for a sufficient balance to complete the request (Step 338). An insufficient balance 
permits the subscriber to again enter the amount he/she will exchange (Step 340-342), whereby Session Manager A 
31 will terminate the transaction (Step 345) if no new amount is entered. Entry of a new amount returns the process 
to Step 338 to check for sufficient funds to meet the new request. When the funds are sufficient for the exchange 

40 request, a Network 25 sign-on using Steps 50-168 is commenced. 

After the Network 25 sign-on, the Network 25 checks if a bank or financial institution has been selected (Step 346). 
If a bank or financial institution was not chosen earlier, To Teller A 34 must prompt the Network Server 26, through 
Session Manager A 31 . for a list of banks or financial institutions that will provide the exchange (Steps 348-350). The 
Network Server 26 sends the list (along with rates) to the subscriber through the To Teller A 34 and To Subscriber A 

45 33 applications (Steps 352-356). 

After prompting (Step 357, Fig. 47 A), the subscriber chooses a bank or financial institution, or ends the transaction 
(Step 359). When a bank or financial institution is chosen, a session is established with the Teller money module 5 
chosen using Steps 1 90-258 described above. After a session is established, To Teller A 34 sends the amount of dollars 
to be exchanged for pounds (Step 360) using Steps 2-8 for encrypting and transmitting a message. 

50 To ensure that the subscriber still wants to proceed with the exchange. To Transaction B 49 sends the current 
exchange rate to the subscriber using process Steps 2-8 (Step 362). At this point, To Subscriber A 33 prompts the 
subscriber with the bank's exchange rate and if the subscriber does not wish to proceed, the transaction is aborted by 
following Steps 500-524 (Steps 364-366). If the transaction is to proceed, the dollars are transferred from Transactbn 
money module A 4 to Teller money module B 5 using Steps 750-770 described herein. 

55 Returning to Figure 48, once the set up of the foreign exchange transaction is accomplished, the proper accounting 

transactions are posted (Step 368; also illustrated in Figure 15, Step 1) to reflect the dollars that have just been trans- 
ferred. A session is established between Teller money module B 5 and a Money Generator module 6 via Steps 1 90-258. 
Teller money module B 5 requests the proper pound notes 1 1 through process Steps 780-792. The notes 1 1 are returned 
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etary systems. 

Operation of the invention has been described primarily with currency notes and credit notes that can be used by 
subscribers in the same processes. It wiD be understood that the described system can also be adapted to other 
monetary instruments. For example, personal and corporate checks and bank drafts could be provided by enhancing 

5 several of the Transactor applications. More complicated multiparty payment processes such as tetters of credit and 
banker's acceptances could also be provided with appropriate changes to the system. It may also be possible to adapt 
the system of the invention to provide corporate financial obligations such as commercial paper. 

Moreover, although the invention has been described in detail with particular reference to a prefened embodiment 
thereof, it should be understood that the invention is capable of other and different embodiments, and its details are 

10 capable of modifications in various obvious respects. As is readily apparent to those skilled in the art, variations and 
modifications can be affected while remaining within the scope of the appended claims. Accordingly, the foregoing 
disclosure, desertion, and figures are for illustrative purposes only, and do not in any way limit the invention, which 
is defined only by the claims. 

is 

Claims 

1 . An electronic monetary system comprising 

20 a computer controlled accounting system associated with an issuing bank (1 ); 

a money generator module (6) associated with said issuing bank (t ), that generates electronic representations 
of currency (11 ), wherein a money Issued liability account in said accounting system is credited by an amount 
associated with generated electronic representations of currency; 

a teller module (5) associated with said issuing bank (1 ), capable of storing said electronic representations of 
25 currency (11), and intermediating banking transactions involving said electronic representations of currency 

(11): 

a transaction module (4) capable of storing said electronic representations of currency (11 ), performing on- 
line transactions with said teller module (5), and exchanging said electronic representations ol currency (11) 
with other transaction modules (4) in ofl-line transactions; 
30 where said electronic representations of currency (1 1 ) each include an original monetary value generated by 

said money generator module (6). a transferred monetary value, and a module Identifier that designates the 
module which has received said electronic representation of currency; and 

said teller and transaction modules (5, 4) having processors operative, when said modules (5, 4) are functioning 
as transferor modules transferring one of said electronic representations of currency (11 ) to a transferee mod- 
35 ule, to generate a transfer record having said transferred monetary value and said transferee module identifier 

and to include said transfer record and said initial monetary value in said transferred electronic representation 
of currency. 

2. The electronic monetary system of claim 1 , characterized in that said money generator module (6) and said teller 
40 module (5) are embodied in a device having a single processor. 

3. The electronic monetary system of claim 1 , characterized in that said transaction module (4) and said teller module 
(5) each have a note directory (39) for keeping track of a current monetary value for each of said electronic rep- 
resentations of currency (11) stored therein. 

45 

4. The electronic monetary system of claim 3, characterized in that said current monetary value recorded in said note 
directory (39) of said transferor module, and associated with one of said electronic representations of currency 
(11) stored therein, is decremented by said transferred monetary value upon transferring said transferred electronic 
representation of currency (11 ) to said transferee module. 

so 

5. The electronic monetary system of claim 1, characterized in that said electronic representations of currency (11) 
include a money generator digital signature produced by said money generator (6) and a transferor digital signature 
produced by said transferor module. 

55 6. The electronic monetary system of claim 5, characterized in that said electronic representations of currency (11) 
include certificates corresponding to said money generator digital signature, and said transferor digital signature, 
where each of said certificates includes a module identifier and a first cryptographic key of said digital signature 
producer, and where said first cryptographic key is used to validate said corresponding digital signature. 
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said teller module (5), said money generator module (6) generating a new replacement electronic representation 
of currency (11) having a new expiration date, and said teller module (5) transferring said new replacement elec- 
tronic representation ol currency (11) to said transaction module (4). 

s 20. The electronic monetary system of claim 14, characterized in that said money generator, teller, and transaction 
modules (4) are tamper-proof devices that are capable of communicating via cryptographicafly secure sessions. 

21. The electronic monetary system of claim 20, characterized in that each said module may commit by logging a 
transaction so that it can no longer abort said transaction by rolling-back its state; and wherein each said module 

10 may abort during said transaction by following a programmed abort routine, where control is transferred to said 
abort routine from other routines or a time-out protocol. 

22. An electronic monetary system comprising 

is a computer controlled accounting system associated with an Issuing bank (1 ); 

a money generator module (6) associated with said issuing bank (1 ). that generates electronic representations 
of currency (1 1 ), wherein a money issued liability account in said accounting system is credited by an amount 
associated with generated electronic representations of currency, 

a teller module (5) associated with sard issuing bank (1), capable of storing said electronic representations of 
20 currency (11), and intermediating banking transactions involving said electronic representations of currency 

01); 

a transaction module (4) capable of storing said electronic representations of currency (11), performing on- 
line transactions with said teller module (5), and exchanging said electronic representations of currency (11 ) 
with other transaction modules (4) In off-tine transactions; 

25 a security server (27) used for implementing the security of the electronic monetary system; 

where said money generator module (6), said teller module (5), and said transaction module (4) are each 
associated with a unique module identifier contained within a certificate that is digitally signed by said security 
server (27), where said certificates are only valid for a limited period of time, after which time said associated 
module will not be able to transact with other modules until a new certificate is obtained; 

30 wherein said new certificate and compromised module identifiers are obtained when said module performs 

initial network connection to a network having one or more security servers; 

wherein said module will not transact with any other module having one of said compromised module identi- 
fiers. 

35 23. The electronic monetary system of claim 22, characterized in that said money generator module (6) and said teller 
module (5) are embodied in a device having a single processor. 

24. The electronic monetary system of claim 22, characterized in that said accounting system maintains money due 
and money in transit accounts during deposits and withdrawals of said electronic representations of currency (11 ). 

40 

25. The electronic monetary system of claim 22, characterized in that said security server (27) distributes a certificatory 
key, when required. 

26. The electronic monetary system of claim 22, characterized in that said security server (27) digitally signs an account 
« profile having data fields including a bank identifier, an account number, and an indication of account type, where 

said account profile is used by said transaction module (4) to access a subscriber account identified by said account 
number. 

27. The electronic monetary system of claim 22, characterized In that said money generator module (6), teller module 
so (5), transaction module (4), and security server (27) are tamper-proof devices capable of communicating via cryp- 

tographically secure sessions. 

28. The electronic monetary system of claim 27. characterized in that each said module and said security server (27) 
may commit by logging a transaction so that it can no longer abort said transaction by rolling-back its state; and 

55 wherein each said module and said security server (27) may abort during said transaction by following a pro- 

grammed abort routine, where control is transferred to said abort routine from other routines or a time-out protocol. 

29. An electronic monetary system comprising 
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a transaction module (4) that stores said electronic representations of currency (11), performs on-line trans- 
actions with said plurality of second teller modules (5), and exchanges said electronic representations of cur- 
rency (11) with other transaction modules (4) in off-line transactions; 

where said first teller module (5) has a first processor that intermediates transactions among said first account- 
5 ing system, said money generator module (6), and said second teller module (5); and 

where said second tetter module (5) has a second processor that intermediates transactions among said sec- 
ond accounting system, said first teller module (5), and said transaction module (4). 

38. The electronic monetary system of claim 37, characterized in that said transaction module (4) also performs on- 
to line transactions With said teller module (5), and wherein said first teller module (5) also intermediates transactions 

involving said transaction module (4). 

39. The electronic monetary system of claim 37, characterized in that said money generator module (6) and said first 
teller module (5) are embodied in an electronic processing device controlled by said first processor. 

15 

40. The electronic monetary system of claim 37, characterized in that said first and second accounting systems main- 
tain money due and money in transit accounts during deposits and withdrawals of said electronic representations 
of currency (11). 

20 41. The electronic monetary system of claim 37, characterized in that said money generator, transaction, and teller 
modules (6, 4, 5) are tamper-proof devices capable of communicating via cryptographically secure sessions. 

42. The electronic monetary system of claim 41, characterized in that each said module may commit by logging a 
transaction so that it can no longer abort said transaction by rolling-back its state; and wherein each said module 

25 may abort during said transaction by following a programmed abort routine, where control is transferred to said 
abort routine from other routines or a time-out protocol. 

43. An electronic monetary system comprising 

30 a plurality of computer controlled accounting systems associated with a plurality of issuing banks (1); 

a plurality of money generator modules (6) associated with said plurality of Issuing banks, that generate elec- 
tronic representations ol currency (11), wherein money issued liability accounts in said accounting systems 
are credited by amounts associated with generated electronic representations of currency; 
a plurality of teller modules (5) associated with said plurality of issuing banks (1). capable of storing said 

3S electronic representations of currency (11 ); 

a data processing system associated with a clearing bank, that clears said electronic representations of cur- 
rency and maintains a clearing bank accounting system in which said plurality of issuing banks each has an 
account; 

where each of said electronic representations of currency (11) includes an issuing bank identifier; and 
40 where each of said plurality of teller modules (5) sends electronic representations of currency (11 ) deposited 

at its issuing bank (1 ) but issued by another issuing bank (1 ) to said clearing bank (3) for balancing said issuing 
bank accounts and for sending each said electronic representation of currency (11 ) back to said Issuing bank 
(1) indicated by its issuing bank identifier. 

<$ 44. The electronic monetary system of claim 43, characterized in that at least one of said money generator modules 
(6) and one of said teller modules (5) are embodied in a device having a single processor. 

45. The electronic monetary system of claim 43, characterized in that said accounting systems maintain money in 
transit and money due accounts during clearing of said electronic representations of currency (11 ). 

50 

46. The electronic monetary system ol claim 43, characterized in that said money generator modules (6) and said 
teller modules (5) are tamper-proof devices capable of communicating via cryptographically secure sessions. 

47. The electronic monetary system of claim 46. characterized in that each said module may commit by logging a 
55 transaction so that it can no longer abort said transaction by rolling-back its state; and wherein each said module 

may abort during said transaction by following a programmed abort routine, where control is transferred to said 
abort routine from other routines or a lime-out protocol. 
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40. An electronic monetary system comprising 

a plurality of computer controlled accounting systems associated with a plurality of issuing banks (1 ); 
a plurality of money generator modules (6) associated with said plurality of issuing banks, that generate elec- 
tronic credit authorizations (11 ), wherein credit lines of subscrtoer's loan accounts in said accounting systems 
are drawn upon by amounts associated with generated electronic credit authorizations; 
a plurality of teller modules (5) associated with said plurality of issuing banks (1), capable of storing said 
electronic credit authorizations (11); 

a data processing system associated with a clearing bank, that clears said electronic credit authorizations and 
maintains a clearing bank accounting system in which said plurality of issuing banks each has an account; 
where each of said electronic credit authorizations (11) includes an issuing bank identifier; and 
where each of said plurality of teller modules (5) sends electronic credit authorizations (11 ) deposited at its 
issuing bank (1) but Issued by another issuing bank (1) to said clearing bank (3) for balancing said issuing 
bank accounts and for sending each said electronic credit authorization (11) back to said issuing bank (1) 
indicated by its issuing bank identifier. 

49. The electronic monetary system of claim 48, characterized in that at least one of said money generator modules 
(6) and one of said teller modules (5) are embodied in a device having a single processor. 

50. The electronic monetary system of claim 48, characterized in that said accounting systems maintain money in 
transit and money due accounts during clearing of said electronic credit authorizations (11). 

51. The electronic monetary system of claim 4B, characterized in that said money generator modules (6) and said 
teller modules (5) are tamper-proof devices capable of communicating via cryptographically secure sessions. 

52. The electronic monetary system of claim 51, characterized in that each said module may commit by logging a 
transaction so that it can no longer abort said transaction by roiling-back its state; and wherein each said module 
may abort during said transaction by following a programmed abort routine, where control is transferred to said 
abort routine from other routines or a time-out protocol. 

53. An electronic monetary system comprising 

a computer controlled accounting system and a computer Implemented money issued reconciliation system 
(23) associated with an issuing bank (1 ); 

a money generator module associated with said issuing bank, that generates electronic representations of 
money (11 ) that are accounted for in said accounting system; 

a teller module (5) associated with said issuing bank (1), capable of storing said electronic representations of 
money (11); 

where said electronic representations of money (11) include a note identifier used to uniquely identify each 
said electronic representation of money (11), and a list of transfer records to provide value subdividabiltty of 
each said electronic representaiton of money; 

where said money issued reconciliation system (23) maintains a record, derived from said money generator 
module, of said electronic representations of money (11) that issued from said issuing bank (1 ); and 
where electronic representations of money (11 ) that are deposited are sent to said money issued reconciliation 
system (23) having a processor for matching sad record of electronic representations of money (11) that 
issued to those subdivided electronic representations of money (11) deposited; and 
where unmatched cases may indicate note counterfeiting in said electronic monetary system. 

54. The electronic monetary system of claim 53, characterized in that said money generator module (6) and said teller 
module (5) are embodied in a device having a single processor. 

55. The electronic monetary system of claim 53, characterized in that each said module may commit by logging a 
transaction so that it can no longer abort said transaction by rolling-back its state; and wherein each said module 
may abort during said transaction by following a programmed abort routine, where control is transferred to said 
abort routine from other routines or a time-out protocol. 

56. An electronic monetary system comprising 
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a computer controlled accounting system and a computer implemented transaction reconciliation system (22) 
associated with an issuing bank (1); 

a money generator module associated with said issuing bank, that generates electronic representations of 
money that are accounted for in said accounting system; 

a teller module (5) associated with said issuing bank (1), capable of storing said electronic representations of 
money (11); 

where transaction records from said money generator module (6), said teller module (5). and said on-line 

accounting system are periodically passed to said transaction reconciliation system (22); 

said transaction reconciliation system (22) having a processor for analyzing said transaction records to ensure 

that teller transactions match the appropriate accounting transactions and to ensure that money generator 

module transactions match the appropriate teller transactions and accounting transactions; and 

where any mismatches may indicate incomplete processing or a security breach. 

57. The electronic monetary system of claim 56, characterized in that said money generator module (6) and said teller 
module (5) are embodied In a device having a single processor. 

58. The electronic monetary system of claim 56, characterized in that each said module may commit by logging a 
transaction so that it can no longer abort said transaction by rolling-back its state; and wherein each said module 
may abort during said transaction by following a programmed abort routine, where control is transferred to said 
abort routine from other routines or a time-out protocol. 



Patentansprflche 

1 . Elektronisches Zahlungsverkehrsystem, das folgendes umfaBt: 

ein computergesteuertes Abrechnungssystem, das einer Emissionsbank (1) zugeordnet ist; 
ein der genannten Emissionsbank (1 ) zugeordnetes Geldgeneratormodul (6), das elektronische Darstellungen 
von Geld (11) erzeugt, wobei auf einem Geidemissions-Passivkonto in dem genannten Abrechnungssystem 
ein Betrag gutgeschrieben wird, der den erzeugten elektronischen Darstellungen von Geld zugeordnet ist; 
ein der genannten Emissionsbank (1) zugeordnetes Terminalmodul (5), das die genannten elektronischen 
Darstellungen von Geld(11)speichern kann, unddas bei Banktransaktionen, die die genannten elektronischen 
Darstellungen von Geld (11) aufweisen. lntermedi§rfunktionen ausfOhrt; 

ein Transaktionsmodul (4), das die genannten elektronischen Darstellungen von Geld (11) speichern kann, 
wobei das Modul ferner Online-Transaktionen mit dem genannten Terminalmodul (5) ausfuhren und die ge- 
nannten elektronischen Darstellungen von Geld (11) in Offline -Transaktionen mit anderen Transaktionsmo- 
dulen (4) austauschen kann; 

wobei die genannten elektronischen Darstellungen von Geld (11) jeweils einen von dem genannten Geldge- 
neratormodul (6) erzeugten ursprOnglichen Geldwert, einen Obermittelten Geldwert und einen Modulidentifi- 
zierer aufweisen, der das Modul bezeichnet, das die genannte elektronische Darstellung von Geld emptangen 
hat; und 

wobei die genannten Terminal- und Transaktionsmodule (5, 4) Prozessoren aufweisen, die bei einer Funklion 
der genannten Module (5, 4) als Clbertragungsmodule, die eine der genannten elektronischen Darstellungen 
von Geld (11) zu einem Empfangenrnodul ubertragen, derart funktionsfahig sind, daQ sie einen Obertragungs- 
datensatz erzeugen, der den genannten Obertragenen Geldwert und den genannten Empfangermodulidenti- 
fizierer aufweist, und wobei der genannte Obertragungsdatensatz und der genannte ursprungliche Geldwert 
in der genannten elektronischen Darstellung von Geld enthalten sind. 

2. Elektronisches Zahlungsverkehrsystem nach Anspruch 1, dadurch gekennzeichnet, da8 das genannte Geldge- 
neratormodul (6) und das genannte Terminalmodul (5) In einer Vorrlchtung mit einem einzigen Prozessor vorge- 
sehen sind. 

3. Elektronisches Zahlungsverkehrsystem nach Anspruch 1, dadurch gekennzeichnet. daft das genannte Transak- 
tionsmodul (4) und das genannte Terminalmodul (5) jeweils ein Notenverzeichnis(39) aufweisen, urn einen aktu- 
ellen Geldwert f Or jede der darin gespeicherten genannten elektronischen Darstellungen von Geld (11 ) aufzuzeich- 
nen. 

4. Elektronisches Zahlungsverkehrsystem nach Anspruch 3, dadurch gekennzeichnet, daft der in dem genannten 



41 



EP 0 542 298 B1 

Notenverzeichnis (39) des genannten Obertragungsmoduls gespeicherte aktuelle Geldwert. der einem der darin 
gespeicherten elektronischen Darstellungen von Geld (11) zugeordnet 1st. nach der Obertragung der genannten 
elektronischen Darstellung von Geld (11) zu dem genannten Empfangermoduldurch den genannten ubertragenen 
GekJwert vermindert wird. 

5. Elektronisches Zahlungsverkehrsystem nach Anspruch 1 , dadurch gekennzeichnet. cfeB die genannten elektroni- 
schen Darstellungen von Getd (11) eine von dem genannten Geldgenerator (6) erzeugte digitate Geldgenerator- 
unterschrift sowie eine von dem genannten Obertragungsmodul erzeugte digitale Obertragungsunterschrift auf- 
weisen. 

6. Elektronisches Zahlungsverkehrsystem nach Anspruch 5, dadurch gekennzeichnet, daB die genannten elektroni- 
schen Darstellungen von Geld (11) Bestatigungsvermerke aufweisen, die der genannten digitalen Geldgenerator- 
unterschrift und der genannten digitalen Ubertragungsunterschrilt entsprechen, wobei jeder der genannten Be- 
statigungsvermerke einen Modulldentifizlerer sowie einen ersten kryptographischen SchlOssel des Erzeugers der 
genannten digitalen Unterschrift aufwelst, und wobei der genannte erste kryptographische SchlOssel zur Bestati- 
gung bzw. zur VaJidierung der genannten entsprechenden digitalen Unterschrift verwendet wird. 

7. Elektronisches Zahtungsverkehrsystern nach Anspruch 6, dadurch gekennzeichnet, daB die genannten Bestati- 
gungsvermerke von einem Sicherheits-Server (27) digital unterschrieben werden, der einer Bestatigungsvertre- 
tungseinrichtung zugeordnet ist, und wobei die genannten Bestatigungsvermerke unter verwendung eines zweiten 
kryptographischen Schlussels des genannten Sicherheits-Servers (27) bestatigt werden konnen, der fur das ge- 
nannte Terminalmodul (5) und fur das genannte Obertragungsmodul (4) verffigbar ist. 

8. Elektronisches Zahlungsverkehrsystem nach Anspruch 1 , dadurch gekennzeichnet. daB der genannte Clbertra- 
gungsdatensatz ferner das Ubertragungs- bzw. das Oberweisungsdatum anzeigt. 

9. Elektronisches Zahlungsverkehrsystem nach Anspruch 1 , dadurch gekennzeichnet. daB die genannten elektroni- 
schen Darstellungen von Geld (11) eine Liste von Obertragungsdatensatzen aufweisen, die jeweils einen Emp- 
fangermodulidentifizierer aufweisen. 

10. Elektronisches Zahlungsverkehrsystem nach Anspruch 9, dadurch gekennzeichnet, daB das genannte Empfan- 
germodul bestatigt. daB der letzte Obertragungsdatensatz in der genannten ubertragenen elektronischen Darstel- 
lung von Geld (11) einen EmpfSngerrnodulidenlifizierer aufweist, der einem Modulidentifizierer des genannten 
Obertragungsmoduls entspricht. 

1 1 . Elektronisches Zahlungsverkehrsystem nach Anspruch 1 , dadurch gekennzeichnet. daB es sich bei den genannten 
Geldgenerator-. Terminal- und Transaktionsmodulen (6, 5. 4) um eingriffsichere Vbrrichtungen handed, die uber 
kryptographisch sichere Sitzungen kommunikationsfahig sind. 

12. Elektronisches Zahlungsverkehrsystem nach Anspruch 11. dadurch gekennzeichnet. daB jedes der genannten 
Module (6, 5, 4) 60 konfiguriert ist, daB es als ein modularer Coprozessor einer elektronischen Verarbeitungsvor- 
richtung funktionsfahlg ist. 

1 3. Elektronisches Zahlungsverkehrsystem nach Anspruch 11 , dadurch gekennzeichnet. daB sich jedes der genann- 
ten Module (6, 5, 4) durch Protokollierung einer Transaktion verpflichten kann, so daB kein Abbruch der genannten 
Transaktion durch Wiederherstellung des Zustands durchgefuhrt werden kann; und wobei jedes der genannten 
Module wahrend der genannten Transaktion durch Befolgen einer programmierten Abbruchroutine einen Abbruch 
durchfuhren kann, wobei die Steuenjng von anderen Routinen oder einem Unterbrechungsprotokoll ubertragen 
wird. 

14. Elektronisches Zahlungsverkehrsystem, das folgendes umfaBt: 

ein computergesteuertes Abrechnungssystem. das einer Emissionsbank (1) zugeordnet ist; 
ein der genannten Emissionsbank (1 ) zugeordnetes Geldgeneratormodul (6). das elektronische Darstellungen 
von Geld (11) erzeugt, wobei auf einem Geldemissions-Passivkonto in dem genannten Abrechnungssystem 
ein Betrag gutgeschfieben wird. der den erzeugten elektronischen Darstellungen von Geld zugeordnet ist; 
ein der genannten Emissionsbank (1) zugeordnetes Terminalmodul (5), das die genannten elektronischen 
Darstellungen von Geld ( 11 ) speichem kann, und das bei Banktransaktionen, die die genannten elektronischen 
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Darstellungen von Geld (11) aufweisen, Intermedtarfunktionen ausfflhrt; 

ein Transaktionsmodul (4), das die genannten eleklronischen Darstellungen von Geld (11) speichern kann, 
wobei das Modul femer Online-Transaktionen mit dam genannten Terminalmodul (5) ausfuhren und die ge- 
nannten eleklronischen Darstellungen von Geld (11) in Olfline-Transaktionen mit anderen Transaktionsmc- 

5 dulen (4) austauschen kann; 

wobei die genannten eleklronischen Darstellungen von Geld (11) sin Verfallsdatum aulweisen; 
wobei die genannten anderen Transaktionsmodule (4) Prozessoren aufweisen, die die Annahme versuchter 
Obertragungen der genannten elektronischen Darstellungen von Geld (11) abweisen konnen. wenn die ge- 
nannten versuchten Obertragungen nach dem Verfallsdatum der genannten elektronischen Darstellungen von 

io Geld (11) auftreten. 

1 5. Eleklronisches Zahlungsverkehrsystem nach Anspruch 14, dadurch gekennzeichnet, daB das genannte Geldge- 
neralormodul (6) und das genannte Terminalmodul (5) in einer Vorrchtung mil einem einzigen Prozessor vorge- 
sehen sind. 

is 

16. Elektronisches Zahlungsverkehrsystem nach Anspruch 14, dadurch gekennzeichnet, da8 das genannte Abrech- 
nungssystem wahrend Einzahlungen und Auszahlungen der genannten elektronischen Darstellungen von Geld 
(11) Forderungskonten und Duchgangskonten f Ohrt. 

20 17. Elektronisches Zahlungsverkehrsystem nach Anspruch 14 ( dadurch gekennzeichnet, daB das genannte Verfalls- 
datum abhangig von einem Geidwert variiert, der den genannten elektronischen Darstellungen von Geld (11) zu- 
geordnet 1st. 

18. Elektronisches Zahlungsverkehrsystem nach Anspruch 14, dadurch gekennzeichnet, daB die in dem genannten 
25 Transaktionsmodul (4) gespeicherten elektronischen Darstellungen von Geld (11) aktualisiert werden, wenn eine 

Transaktion mit dem genannten Terminalmodul (5) durchgefuhrt wird. 

19. Elektronisches Zahlungsverkehrsystem nach Anspruch 18, dadurch gekennzeichnet, daB die genannten elektro- 
nischen Darstellungen von Geld (11) von dem genannten Transaktionsmodul (4) aktualisiert werden, die die ge- 

30 nannten gespeicherten elektronischen Darstellungen von Geld (11 ) zu dem genannten Terminalmodul (5) uber- 

tragen, wobei das genannte Geldgeneratormodul (6) eine neue ersetzende elektronlsche Darstellung von Geld 
(11 ) erzeugt, die ein neues Verfallsdatum aufweist, und wobei das genannte Terminalmodul (5) die genannie neue 
ersetzende elektronische Darstellung von Geld (11) zu dem genannten Transaktionsmodul (4) ObertrSgt. 

3S 20. Elektronisches Zahlungsverkehrsystem nach Anspruch 1 4. dadurch gekennzeichnet, daB es sich bei den genann- 
ten Geldgenerator-, Terminal- und Transaktionsmodulen (4) urn eingriffsichere Vorrichtungen handelt, die fiber 
kryptographisch sichere Sitzungen kornmunikationsfahig sind. 

21. Elektronisches Zahlungsverkehrsystem nach Anspruch 20, dadurch gekennzeichnet, daB sich jedes der genann- 
40 ten Module durch Protokollierung einer Transaktion verpflichten kann, so daB keln Abbruch der genannten Trans- 

aktion durch Wiederherstellung des Zustands durchgef Ohrt werden kann; und wobei jedes der genannten Module 
wahrend der genannten Transaktion durch Befolgen einer programmierten Abbruchroutlne einen Abbruch durch- 
fuhren kann. wobei die Steuerung von anderen Routinen oder einem Unterbrechungsprotokoll ubertragen wird 

45 22. Elektronisches Zahlungsverkehrsystem, das folgendes umfaBt: 

ein computergesteuertes Abrechnungssystem, das einer Emissionsbank (1) zugeordnet ist; 
ein der genannten Emissionsbank (1 ) zugeordnetes Geldgeneratormodul (6), das elektronische Darstellungen 
von Geld (11) erzeugt, wobei auf einem Geldemisstons-Passivkonto in dem genannten Abrechnungssystem 
so ein Betrag guigeschrieben wird, der den erzeugten elektronischen Darstellungen von Geld zugeordnet ist; 

ein der genannten Emissionsbank (1) zugeordnetes Terminalmodul (5), das die genannten elektronischen 
Darstellungen von Geld (11) speichern kann. und das bei Banktransaktionen, die die genannten elektronischen 
Darstellungen von Geld (11) aulweisen, Intermediarfunklionen ausfuhrt; 

ein Transaktionsmodul (4). das die genannten elektronischen Darstellungen von Geld (11) speichern kann, 
55 wobei das Modul ferner Online-Transaktionen mit dem genannten Terminalmodul (5) ausfuhren und die ge- 

nannten eleklronischen Darstellungen von Geld (11) in Offline-Transaktionen mit anderen Transaktionsmo- 
dulen (4) austauschen kann; 

einen Sicherheits-Server (27), der zur Reallsierung der Sicherheit des elektronischen Zahlungsverkehrsy- 
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stems verwendet wird; 

wobei das genannte Geldgeneratormodul (6). das genannte Terminalmodul (5) und das genannte Transakti- 
onsmodul (4) jeweils einem eindeutigen Modutidentifizierer zugeordnet sind, der sich in einem Bestatigungs- 
vermerk befindet, der eine digitals Unterschrift des genannten Sicherheits-Servers (27) tragi, wobei die ge- 
nannten Bestatigungsvermerke nur Qber einen begrenzten Zeltraum GOItigkeit haben, wobei das genannte 
zugeordnete Modul nach Ablaut dieses Zeilraums nicht mehr In dor Lage ist mit anderen Modulen Transak- 
tionen durchzufGhren, bis ein neuer Bestatigungsvermerk vorgesehen wird; 

wobei der genannte neue Bestatigungsvermerk und die beinhalteten ModulkJentifizierer vorgesehen werden, 
wenn das genannte Modul eine erste Netzverbindung mit einem Nelzwerk herstellt, das einen oder mehrere 
Sicherheits-Server aufweist; 

wobei das genannte Modul mit keinem anderen Modul in Transaktion tritt, das einen der genannten beinhal- 
teten Modutidentifizierer aufweist. 

23. Elektronisches Zahlungsverkehrsystem nach Anspruch 22, dadurch gekennzeichnet, dafl das genannte Geldge- 
neratormodul (6) und das genannte Terminalmodul (5) In elner Vbrrtchtung mil einem einzigen Prozessor vorge- 
sehen sind. 

24. Elektronisches Zahlungsverkehrsystem nach Anspruch 22, dadurch gekennzeichnet, daQ das genannte Abrech- 
nungssystem wahrend Einzahlungen und Auszahlungen der genannten elektronischen Darstellungen von Geld 
(11) Forderungskonten und Duchgangskonten fuhrt. 

25. Elektronisches Zahlungsverkehrsystem nach Anspruch 22, dadurch gekennzeichnet, daB der genannte Sicher- 
heits-Server (27) einen bestatigenden SchlOssei verteilt, falls dies erforderlich isi. 

26. Elektronisches Zahlungsverkehrsystem nach Anspruch 22, dadurch gekennzeichnet, daB der genannte Sicher- 
heits-Server (27) ein Kontenprofil digital unterzeichnet, das Datenfelder aufweist. die einen Bankenidentifizierer, 
eine Kontonummer und eine Indikation der Kontenart aufweisen. wobei das genannte Kontenprofil von dem ge- 
nannten Transaktionsmodul (4) dazu verwendet wird, urn auf ein durch die genannte Kontonummer identifiziertes 
Teilnehmerkonto zuzugreifen. 

27. Elektronisches Zahlungsverkehrsystem nach Anspruch 22. dadurch gekennzeichnet. daB es sich bei dem genann- 
ten Geldgeneratormodul (6), dem Tellermodul (5), dem Transaktionsmodul (4) und dem Sicherhetts-Server (27) 
urn eingriffsichere Vorrichtungen handett, die Ober kryptographisch slchere Sitzungen kommunikationsf&hig sind. 

28. Elektronisches Zahlungsverkehrsystem nach Anspruch 27, dadurch gekennzeichnet, daB sich jedes der genann- 
ten Module und der genannte Sicherheits-Server (27) durch Protokollierung einer Transaktion verpfiichten konnen, 
so daB kein Abbruch der genannten Transaktion durch Wiederherstellung des Zustands durchgef Ohrt werden kann; 
und wobei jedes der genannten Module und der genannte Sicherheits-Server (27) wahrend der genannten Trans- 
aktion durch Befolgen einer programmierten Abbruchroutine einen Abbruch durchfuhren konnen, wobei die Steue- 
rung von anderen Routinen oder einem Unterbrechungsprotokoll Obertragen wird. 

29. Elektronisches Zahlungsverkehrsystem, das folgendes umfaflt: 

ein computergesteuertes Abrechnungssystem, das einer Emissionsbank (1) zugeordnet ist; 
ein der genannten Emissionsbank zugeordnetes Geldgeneratormodul (6), das elektronische Kreditzusagen 
(11) erzeugen. wobei ein Kreditrahmen eines Teilnehmer-Darlehenskontos in dem genannten Abrechnungs- 
system um einen Betrag in Anspruch genommen wird, der den genannten erzeugten elektronisohen Kredit- 
zusagen entspricht; 

ein der genannten Emissionsbank (1) zugeordnetes Terminalmodul (5), das die genannte elektronische Kre- 
ditzusage (11) speichem kann und das Banktransaktionen, die die genannten elektronischen Kreditzusagen 
(11) aufweisen, Intermediarfunktbnen ausfOhrt; 

ein Transaktionsmodul (4), das die genannten elektronischen Kreditzusagen (11) speichern. Online-Transak- 
ttonen mit dem genannten Terminalmodul (5) durchf Qhren sowie die genannte elektronische Kreditzusage (11) 
in einer Offline-Transaktion zu einem anderen Transaktionsmodul (4) Obertragen kann; und 
wobei die genannte elektronische Kreditzusage (11) eine Kontonummer des genannten Teilnehmer-Darle- 
henskontos, einen ursprung lichen Geldbetrag und eine von dem genannten Geldgeneratormodul (6) erzeugte 
digitate Unterschrift aufweist; 

wobei die genannte elektronische Kreditzusage zwischen Transaktionsmodulen in einem Obertragungsgeld- 
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betrag Obertragen werden kann, der Weher oder gleich dem genannten ursprunglichen GeWbetrag 1st; und 
wobei die genannte Emissionsbank (1) bei Einzahlung der genannten elektronischen Kreditzusage (11) das 
genannte Teflnehmer-Daxlehenskonto mit dem genannten ubertragenen Geldbetrag belastet 

s 30. Elektronisches Zahlungsverkehrsystem nach Anspruch 29, dadurch gekennzeichnet, daB das genannte Geldge- 
neratormodul (6) und das genannte Terminalmodul (5) In elner Vorrtehtung mit einem einzigen Prozessor vorge- 
sehen sind. 

31. Elektronisches Zahlungsverkehrsystem nach Anspruch 29, dadurch gekennzeichnet, daB das genannte Abrech- 
10 nungssystem wahrend Einzahlungen und Auszahlungen der genannten elektronischen Kreditzusage (11) Forde- 

rungskonten und Duchgangskonten f uhrt. 

32. Elektronisches Zahlungsverkehrsystem nach Anspruch 29, dadurch gekennzeichnet, daB das genannte Transak- 
tionsmodu! (4) nur einmal die genannte elektronische Kreditzusage (11 ) zu einem anderen Transaktionsmodul (4) 

75 Qberlragen kann. 

33. Elektronisches Zahlungsverkehrsystem nach Anspruch 29, dadurch gekennzeichnet, daB es sich bei dem genann- 
ten Geldgeneratof, den Terminal- und Transaktionsmodulen (4) urn ehgriffsichere Vorrichtungen handelt, die Ober 
kryptographisch sichere Sitzungen kommunikationslahig sind. 

20 

34. Elektronisches Zahlungsverkehrsystem nach Anspruch 33, dadurch gekennzeichnet, daB die genannte elektroni- 
sche Kreditzusage (11) digitate Unterschriften aufweist, die von den genannten Terminal- und Transaktionsmodu- 
len (5, 4) nach der Obertragung der genannten elektronischen Kreditzusage (11) erzeugt werden; und wobei das 
genannte Geldgeneratormodui (6), das genannte Terminalmodul (5) und das genannte Transaktionsmodul (4) 

25 jeweils einem elektronischen Bestatigungsvermerk zugeordnet sind, durch den andere Module ihre Authentizitat 
bestatigen konnen; wobei die genannte Obertragung der genannten elektronischen Kreditzusage (11) von dem 
genannten Transaktionsmodul (4) zu dem genannten anderen Transaktionsmodul (4) ohne Teilnehmeridenttfizie- 
rung durch gefuhrt werden kann. 

so 35. Elektronisches Zahlungsverkehrsystem nach Anspruch 33, dadurch gekennzeichnet, daB sich jedes der genann- 
ten Module durch Protokollierung einer Transaktion verpftichten kann, so daB kein Abbruch der genannten Trans- 
aktion durch Wiederhersteliung des Zustands durchgef uhrt werden kann; und wobei jedes der genannten Module 
wahrend der genannten Transaktion durch Befolgen einer programmierten Abbruchroutine einen Abbruch durch- 
fuhren kann, wobei die Steuerung von anderen Routinen oder einem Unterbrechungsprotokoll Obertragen wird. 

35 

36. Elektronisches Zahlungsverkehrsystem nach Anspruch 29, dadurch gekennzeichnet, daB das genannte Transak- 
tionsmodul (4) sowohl elektronische Darstellungen von Geld (11) als auch elektronische Kredilzusagen (11) spei- 
chern kann, und wobei das genannte Transaktionsmodul (4) sowohl die genannten elektronischen Darstellungen 
von Geld (1 1 ) als auch die genannten elektronischen Kreditzusagen (11) Ober eine kryptographisch sichere Sitzung 

40 in einer elnzigen Transaktionsubertragung zu dem genannten anderen Transaktionsmodul (4) Obertragen kann. 

37. Elektronisches Zahlungsverkehrsystem, das tolgendes umfaBt: 

ein erstes computergesteuertes Abrechnungssystem, das einer Emissionsbank (1) zugeordnet ist; 

45 ein der genannten Emissionsbank (1) zugeordnetes Geldgeneratormodui, das elektronische Darstellungen 

von Geld (11) erzeugt, wobei auf einem Geldemissions-Passivkonto in dem genannten Abrechnungssystem 
ein Betrag gutgeschrieben wird, der den erzeugten elektronischen Darstellungen von Geld zugeordnet ist; 
ein der genannten Emissionsbank (1) zugeordnetes erstes Terminalmodul (5), das diB genannten elektroni- 
schen Darstellungen von Geld (11) speichern kann; 

so eine Mehrzahl zweiter computergesteuerter Abrechnungssysteme, die jeweils einer entsprechenden Bank (2) 

zugeordnet sind, wobei jede entsprechende Bank ein Konto in dem genannten ersten Abrechnungssystem 
fOhrt; 

eine Mehrzahl zweiter Terminalmoduie (5). die jeweils einer der entsprechenden Banken (2) zugeordnet sind, 
wobei die Module jeweils die genannten elektronischen Darstellungen von Geld (11) speichern konnen; 
55 ein Transaktionsmodul (4), das die genannten elektronischen Darstellungen von Geld (4) speichert, Online- 

Transaktionen mit der genannten Mehrzahl zweiter Terminalmoduie (5) durchf Ohrt sowie Auslauschoperatio- 
nen der genannten elektronischen Darstellungen von Geld (11) mit anderen Transaktionsmodulen (4) in Ofl- 
line-Transaktionen; 
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wobei das genannle erste Terminalmodul (5) einen ersten Prozessor autweist, der bei Transaktbnen zwischen 
dem genannten ersten Abrechnungssystem, dem genannten Geldgeneratormodul (6) und dem genannten 
zweiten Terminafcrnodul (5) Intermediarfunktionen ausfOhrt; und 

wobei das genannte zweite Terminalmodul (5) einen zweHen Prozessor aufweist, der bei Transakttonen zwh 
5 schen dem genannten zweiten Abrechnungssystem, dem genannten ersten Terminalmodul (5) und dem ge- 

nannten Transaktionsmodul (4) Interrned&rfunktionen ausfOhrt. 

38. Elektronisches Zahlungsverkehrsystem nach Anspruch 37, dadurch gekennzeichnet, daB das genannte Transak- 
tionsmodul (4) ebenfalls Online-Transaktionen mit dem genannten Terminalmodul (5) ausfGhrt, und wobei das 

io genannte erste Terminalmodul (5) auch Intermediarfunktionen in Verbindung mit dem genannten Transaktions- 
modul (4) ausf Ohrt. 

39. Elektronisches Zahlungsverkehrsystem nach Anspruch 37, dadurch gekennzeichnet, daG das genannte Geldge- 
neratormodul (6) und das genannte erste Terminalmodul (5) in einer elektronischen Verarbertungsvorrichtung vor- 

75 gesehen sind, die durch den genannten ersten Prozessor gesteuert wird. 

40. Elektronisches Zahlungsverkehrsystem nach Anspruch 29, dadurch gekennzeichnet, daG die genannten ersten 
und zweiten Abrechnungssysteme wahrend Einzahlungen und Auszahlungen der genannten elektronischen Dar- 
stellungen von Geld (11) Forderungskonten und Durchfuhrungskonten fOhren. 

20 

41. Elektronisches Zahlungsverkehrsystem nach Anspruch 37, dadurch gekennzeichnet, daft es sich bei dem genann- 
ten Geldgenerator, den genannten Transaktions- und Terminatmodulen (6, 4, 5) urn elngriffslchere Vbrrichtungen 
handelt. die Ober kryplographtsch sichere Sitzungen kommunikationsfahlg sfnd. 

25 42. Elektronisches Zahlungsverkehrsystem nach Anspruch 41 , dadurch gekennzeichnet, daG sich jedes der genann- 
ten Module durch Protokollierung einer Transaktion verpflichten kann, so daB kein Abbruch der genannten Trans- 
aktion durch Wiederherstellung des Zustands durchgef Ohrt werden kann; und wobei jedes der genannten Module 
wahrend der genannten Transaktion durch Befolgen einer programmierten Abbruchroutine einen Abbruch durch- 
fuhren kann, wobei die Steuerung von anderen Routinen oder einem Unterbrechungsprotokoll ubertragen wird. 

30 

43. Elektronisches Zahlungsverkehrsystem, das folgendes umfaBt: 

eine Mehrzahl computergesteuerter Abrechnungssysteme, die einer Mehrzahl von Emissionsbanken (1) zu- 
geordnet sind; 

35 eine Mehrzahl der genannten Mehrzahl von Emissionsbanken zugeordneter Geldgeneratormodule (6), die 

elektronische Darstellungen von Geld (1 1 ) erzeugen, wobei auf Geldemissions-Passivkonten in den genann- 
ten Abrechnungssystemen Betrage gutgeschrieben werden, die den erzeugten elektronischen Darstellungen 
von Geld zugeordnet sind; 

eine Mehrzahl der genannten Mehrzahl von Emissionsbanken (1) zugeordneter Terminalmodule (5), die die 
40 genannten elektronischen DarsteUungen von Geld (11) speichern konnen; 

eln Datenverarbeitungssyslem, das einer Clearingbank zugeordnet ist, da6 die genannten elektronischen Dar- 
stellungen von Geld verrechnet und eln Clearingbank-Abrechnungssystem fOhrt, in dem jede der Mehrzahl 
von Emissionsbanken ein Konto aufweist; 

wobei jede der genannten elektronischen Darstellungen von Geld (11) einen Emissionsbankidentifizierer auf- 
45 weist; und 

wobei jedes der Module der genannten Mehrzahl von Terminalmodulen (5) elektronische Darstellungen von 
Geld (11), die bei dessen Emlssionsbank (1 ) eingezahlt werden, jedoch von einer anderen Emissionsbank (1 ) 
ausbezahlt werden, zu der genannten Clearingbank (3) ubermittelt, so daB die genannten Emissionsbanken- 
konten ausgeglichen werden und so daG Jede der genannten elektronischen Darstellungen von Geld (11) 
so zurOck zu der genannten Emissionsbank (1 ) Obemnittelt werden, die durch deren Emissionsbankidentifizierer 

bezeichnet wird. 

44. Elektronisches Zahlungsverkehrsystem nach Anspruch 43, dadurch gekennzeichnet, daB mindeslens eines der 
genannten Geldgeneratormodule (6) und eines der genannten TerminalmodLile (5) in einer Vorrichtung mil einem 

55 einzigen Prozessor vorgesehen sind. 

45. Elektronisches Zahlungsverkehrsystem nach Anspruch 43, dadurch gekennzeichnet, daB die genannten Abrech- 
nungssysteme wahrend der Verrechnung bzw. dem Clearing der genannten elektronischen Darstellungen von 
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Geld (11) Duchgangskonten und Fuhrungskonten fuhren. 

46. Elektronisches Zahlungsverkehrsystem nach Anspruch 43, dadurch gekennzeichnet, daG es sich bei den genann- 
ten Geldgeneratormodulen (6) und don genannten Tenminalnx>dulen (5) urn eingriflsichere Vorrtchtungen handell, 

5 die Ober kryptographisch sichere Sitzungen kommunikattonsfahig sind. 

47. Elektronisches Zahlungsverkehrsystem nach Anspmch 46, dadurch gekennzeichnet. daB sich jedes der genann- 
ten Module durch Protokollierung einer Transaktion verpflichten kann, so daB kein Abbruch der genannten Trans- 
aktion durch Wiederherstellung des Zustands durchgef uhrt werden kann; und wobei jedes der genannten Module 

io wahrend der genannten Transaktion durch Befolgen erner programmierten Abbruchroutine einen Abbruch durch- 

f uhren kann, wobei die Steuerung von anderen Routrten oder einem Unterbrechungsprotokoll Obertragen wird, 

48. Elektronisches Zahlungsverkehrsystem, das foJgendes umfaBt: 

15 eine Mehrzahl computergesteuerter Abrechnungssysteme, die einer Mehrzahl von Eniissionsbanken (1) zu- 

geordnet sind; 

eine Mehrzahl der genannten Mehrzahl von Emissionsbanken zugeordneter Geldgeneratormodute (6), die 
elektronische Kreditzusagen (11) erzeugen. wobei Kreditrahmen von Teilnehmer-Darlehenskonten in den ge- 
nannten Abrechnungssystemen um Betrage in Anspruch genommen werden, die den genannten erzeugten 
^0 elektronischen Kreditzusagen entsprechen; 

eine Mehrzahl der genannten Mehrzahl von Emissionsbanken (1) zugeordneter Terminalmodule (5), die die 
genannten elektronischen Kreditzusagen (11) speichern kdnnen; 

ein Datenverarbeitungssystem, das einer Clearingbank zugeordnet isl, das die genannten elektronischen Kre- 
ditzusagen verrechnet und ein Clearingbank- Abrechnungssystem fOhrt, in dem jede Emissfonsbank der ge- 

2S nannten Mehrzahl von Emissionsbanken ein Konto aufweist; 

wobei jede der genannten elektronischen Kreditzusagen (11 ) einen Emissionsbankidentifizierer aufweist; und 
wobei jedes Terminalmodul (5) der genannten Mehrzahl von Terminalmodulen elektronische Kreditzusagen 
(11 ), die auf deren Emissionsbank (1 ) gutgeschrieben sind, die jedoch von einer anderen Emissionsbank (1) 
gewahrt worden sind, zu einer Clearingbank (3) Obermittelt, so daB die Emissionsbankenkonten ausgeglichen 

30 werden und so daB jede der genannten elektronischen Kreditzusagen (11) zuruck zu der genannten Emissi- 

onsbank (1 ) Obermittelt wird, die durch deren Emissionsbankidentifizierer bezetchnet ist. 

49. Elektronisches Zahlungsverkehrsystem nach Anspruch 48, dadurch gekennzeichnet, daB mindestens eines der 
genannten Geldgeneratormodule (6) und eines der genannten Terminalmodule (5) in einer Vorrichtung mit einem 

35 einzigen Prozessor vorgesehen sind. 

50. Elektronisches Zahlungsverkehrsystem nach Anspruch 48. dadurch gekennzeichnet. daB die genannten Abrech- 
nungssysteme wahrend der Verrechnung bzw. dem Clearing der genannten elektronischen Kreditzusagen (11) 
Durchgangskonten und Forderungskonten luhren. 

40 

51. Elektronisches Zahlungsverkehrsystem nach Anspruch 48, dadurch gekennzeichnet, daB es sich bei den genann- 
ten Geldgeneratormodulen (6) und den genannten Terminalmodulen (5) um e in griffs ich ere Vorrichtungen handett, 
die uber kryptographisch sichere Sitzungen kommunikatbnsfahig sind. 

45 52. Elektronisches Zahlungsverkehrsystem nach Anspruch 51 , dadurch gekennzeichnet, daB sich jedes der genann- 
ten Module durch Protokollierung einer Transaktion verpflichten kann, so daB kein Abbruch der genannten Trans- 
aktion durch Wiederherstellung des Zustands durchgef uhrt werden kann; und wobei jedes der genannten Module 
wahrend der genannten Transaktion durch Befolgen einer programmierten Abbruchroutine einen Abbruch durch- 
f uhren kann, wobei die Steuerung von anderen Routinen oder einem Unterbrechungsprotokoll Obertragen wird. 

so 

53. Elektronisches Zahlungsverkehrsystem, das foJgendes umfaBt 

ein computergesteuertes Abrechnungssystem sowie ein computerimplementiertes Gekfemissions-Abstim- 
mungssystem (23), das einer Emissionsbank (1) zugeordnet ist; 
55 ein der genannten Emissionsbank zugeordnetes Geldgeneratormodul, das elektronische Darstellungen von 

Geld (11) erzeugt, die in dem genannten Abrechnungssystem abgerechnet werden; 
ein der genannten Emissionsbank (1 ) zugeordnetes Terminalmodul (5), das die genannten Darstellungen von 
Geld (11) speichern kann; 
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wobei die genannten Darstellungen von Geld (11 ) ein Notenverzeichnis auf weisen, das zur a indeutigen Iden- 
tifizierung jeder der genannten elektronischen Darstellungen von Geld (11 ) verwendet wird. und mit einer Uste 
von Obertragungsdatensatzen, die dazu dienen, eine Wertunterteilung jeder der genannten elektronischen 
Darstellungen von Geld vorzusehen; 

wobei das genannte Geldemisslons-Abstimmungssystem (23) einen von dem genannten Geldgeneratormodul 
abgeleiteten Datensatz der genannten elektronischen Darstellungen von Geld (11) f Ohrt, die von der genann- 
ten Emissionsbank (1 ) emittiert werden; und 

wobei die genannten eingezahlten elektronischen Darstellungen von Geld (11 ) zu dem genannten Geldemiss- 
ions-Abstimmungssystem (23) Obermittelt werden, das einen Prozessor zur Abstrnmung des genannten Da- 
tensatzes der emittierten elektronischen Darstellungen von Geld (11) mit den eingezahlten unterteilten elek- 
tronischen Darstellungen von Geld (1 1) aufweist; und 

wobei unabgestimmte Faile Notenfalschungen in dem genannten elektronischen Zahlungsverkehrsy stern an- 
zelgen konnen. 

54. Elektronisches Zahlungsverkehrsyslem nach Anspruch 53, dadurch gekennzeichnet, daft das genannte Geldge- 
neratormodul (6) und das genannte Terminalmodul (5) in einer Vorrtchtung mit einem einzigen Prozessor vorge- 
sehen sind. 

55. Elektronisches Zahlungsverkehrsyslem nach Anspruch 53, dadurch gekennzeichnet, daQ sich jedes der genann- 
ten Module durch Protokollierung einer Transaktion verpflichten kann, sodaB kein Abbruch der genannten Trans- 
aktion durch Wiederherstellung des Zustands durchgef uhrt werden kann; und wobei jedes der genannten Module 
wahrend der genannten Transaktion durch Befolgen einer programmlerten Abbruchroutine einen Abbruch durch- 
f Ohren kann, wobei die Steuerung von anderen Ftoutinen oder einem Unterbrechungsprotokoll Obertragen wird. 

56. Elektronisches Zahlungsverkehrsyslem, das foigendes umfaftt: 

ein computergesteuertes Abrechnungssystem sowie ein computerimplementieries Transaktions-Abstim- 
mungssystem (22), das einer Emissionsbank (1) zugeordnet ist; 

ein der genannten Emissionsbank zugeordnetes Geldgeneratormodul, das elektronische Darstellungen von 
Geld erzeugt, die in dem genannten Abrechnungssystem abgerechnet werden; 

ein der genannten Emissionsbank (1) zugeordnetes Terminalmodul (5), das die genannten elektronischen 
Darstellungen von Geld (11) sp etch em kann; 

wobei Transaktionsdatensatze von dem genannten Geldgeneratormodul (6), dem genannten Terminalmodul 
(5) und dem genannten Online-Abrechnungssystem periodisch zu dem genannten Transaktions-Abstim- 
mungssystem (22) weitergeleitet werden; 

wobei das genannte Transaktions-Abstimmungssystem (22) einen Prozessor zum Analysieren der genannten 
Transaktionsdatensatze aufweist, urn sicherzustellen, daft die Terminaltransaktionen mit den entsprechenden 
Abrechnungstransaktionen Qberetnslimmen, und urn sicherzustellen, daft die Geldgeneratormodultransaktto- 
nen mit den entsprechenden Terminaltransaktionen und Abrechnungstransaktionen ubereinstimmen; und 
wobei etwaige falsche Obereinstimmungen eineunvollkommene Verarbeitungoder einen SicherheitsverstoB 
anzeigen konnen. 

57. Elektronisches Zahlungsverkehrsyslem nach Anspruch 56, dadurch gekennzeichnet, daft das genannte Geldge- 
neratormodul (6) und das genannte Terminalmodul (5) in einer \forrichtung mit einem einzigen Prozessor vorge- 
sehen sind. 

58. Elektronisches Zahlungsverkehrsyslem nach Anspruch 56, dadurch gekennzeichnet, daft sich jedes der genann- 
ten Module durch Protokollierung einer Transaktion verpflichten kann, so daft keih Abbruch der genannten Trans- 
aktion durch Wiederherstellung des Zustands durchgefflhrt werden kann; und wobei jedes der genannten Module 
wahrend der genannten Transaktion durch Befolgen einer programmlerten Abbruchroutine einen Abbruch durch- 
f Ohren kann, wobei die Steuerung von anderen Routinen oder einem Unterbrechungsprotokoll Obertragen wird. 

Revendtcations 

1. Systeme monetaire electronique comprenant : 

- un systeme de comptabilite commands par ordinateur, assocte a une banque emettrice (1 ), 
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- un module producteur de monnaie (6). associe a la banque emettrice (1), qui produit des representations 
electroniques d'argent (11 ), dans lequel un compte d'engagement sur la monnaie 6mise, du systems de comp- 
tabilite, est credite d'un montant associe a des representations electroniques produites d'argent, 

- un module caissier (5) associe a la banque emettrice (1), a mdme de memoriser lesdites representations 
5 electroniques d'argent (11). et de servlr d'interm6diaire pour des transactions bancaires impllquant lesdites 

representations electroniques d'argent (11). 
* un module de transaction (4) a mdme de memoriser lesdites representations electroniques d'argent (11 ), d'exe- 
cuter des transactions en ligne avec le module caissier (5) et tfechanger lesdites representations electroniques 
d'argent (11) avec d'autres modules de transaction (4) dans des transactions en diftere, 
io - lesdites representations electroniques d'argent (11 ) comprenant chacune une valeur monetaire de depart pro- 
duite par le module producteur de monnaie (6), un valeur monetaire transferee et un identificateur de module 
qui designe le module qui a recu ladite representation electronique cf argent {11), et 

- les modules caissier et de transaction (5, 4) comportant des processeurs qui, lorsque fesdits modules (5, 4) 
sont en cours de fonctionnement en tant que modules cedants transterant une des representations electro- 

15 niques d'argent (11 ) a un module cessionnaire, aglssent pour produire un enregistrement de transfert com- 

prenant la valeur monetaire transferee et F identificateur du module cessionnaire et pour inclure i'enregistre- 
ment de transfert et la valeur monetaire de depart dans la representation electronique d'argent transferee. 

2. Systems monetaire electronique suivant la revendication 1 , caracterise en ce que le module producteur de monnaie 
20 (6) et le module caissier (5) sont reunis dans un dispositrf comportant un unique process eur. 

3. Systems monetaire electronique suivant la revendication 1 , caracterise* en ce que le module de transaction (4) et 
le module caissier (5) ont chacun un repertoire de bidets en vue de garder une trace d'une valeur monetaire 
courante pour chacune des representations electroniques cfargent (11) qui y sont memorisees. 

25 

4. Systeme monetaire electronique suivant fa revendication 3, caracterise en ce que la valeur monetaire courante 
enregistree dans le repertoire de billets (39) du module cedant, et associee a Tune desdites representations elec- 
troniques d'argent (1 1 ) qui y sont memorisees, est diminu6e de ladite valeur monetaire transferee kxs d'un transfert, 
au module cessionnaire, de la representation electronique d'argent (11) transferee. 

30 

5. Systeme monetaire electronique suivant la revendication 1 , caracterise en ce que les representations electroniques 
cfargent (1 1 ) susd ites comprennent une signature numerique de producteur de monnaie, produite par le producteur 
de monnaie (6), et une signature numerique de cedant, produite par le module cedant. 

35 6. Systeme monetaire electronique suivant fa revendication 5, caracterise en ce que les representations electroniques 
d'argent (11) susdites comprennent des certificats correspondent a la signature num6rique du producteur de mon- 
naie et a la signature numerique du cedant. chacun des certificats comprenant un identificateur de module et une 
premiere c!6 cryptographique du producteur precite de signature numerique, et en ce que la premiere cie crypto- 
graphique est utilisee pour vatider ladite signature numerique correspondante. 

40 

7. Systeme monetaire electronique suivant ta revendication 6, caracterise en ce que les certificats sont signes nu- 
meriquement par un serveur de securite (27) associe a une agence de certification (28) et en ce que (esdits cer- 
tificats peuvent §tre valides en utilisant une seconde cie cryptographique du serveur de securite (27), qui est 
disponible pour le module caissier (5) et pour le module de transaction (4). 

45 

8. Systems monetaire electronique suivant la revendication 1 , caracterise en ce que I'enregistrement de transfert 
com p rend en outre une indication de la date du transfert. 

9. Systeme monetaire electronique suivant ta revendication 1 , caracterise en ce que les representations electroniques 
so cfargent (1 1 ) susdites comprennent une liste d'enregistrements de transfert qui component chacun un Identfficateur 

du module cessionnaire. 

10. Systeme monetaire electronique suivant la revendication 9, caracterise en ce que le module cessionnaire verifie 
que le dernier enregistrement de transfert, dans ta representation electronique d'argent (11) transferee susdtte. 

55 comporte un identificateur de module cessionnaire qui est le mdme qu'un identificateur de module du module 

cedant. 

11. Systeme monetaire electronique suivant fa revendication 1, caracterise en ce que les modules producteur de 
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monnaie, caissier, et de transaction (6. 5. 4) sont des disposrtifs a rabri d'une falsification et qui sont a meme de 
communiquer par I'intermediaire de cessions cryptographiquement sOres. 

12. Systems monetaire electronique suivant la revendication 11, caracterise en ce que chacun des modules (6, 5, 4) 
5 precltes est configure pour executer une tache a la manlere cf un co-processeur modulaire d'un dispositif de trah 

tement electronique. 

1 3. Systeme monetaire electronique suivant la revendication 11 , caracterisa en ce que chaque module (6, 5, 4) pr6cite 
peut s'engager en inscrivant une transaction de facon a ce qu'il ne puisse plus abandonner ('execution de ladite 

10 transaction en faisant reculer son etat, et en ce que chaque module peut abandonner I'execution pendant ladite 
transaction en suivant un sous-programme d'abandon programme dans lequel la commando est transferee 
d'autres sous-programmes ou d'un protocole a delai d'attente au sous-programme d'abandon. 

14. Systeme monetaire electronique comprenant : 

rs 

- un systeme de comptabilite commands par ordinateur, associe a une banque emettrice (1 ), 

un module producteur de monnaie (6), associe a la banque emettrice (1), qui produrt des representations 
electroniques d'argent (11), dans lequel un compte d'engagement sur la monnaie emise, du systeme de comp- 
tabilite, est credite d'un montant associe a des representations electroniques produites d'argent, 
20 - un module caissier (5) associe a la banque emettrice (1 ), a meme de memoriser lesdites representations 
electroniques d'argent (11), et de servir d'interm6diaire pour des transactions bancaires impliquant lesdites 
representations electroniques d'argent (11 ), 

un module de transaction (4) a meme dememoriser lesdites representations electroniques d'argent (11), cfexe- 
cuter des transactions en ligne avec le module caissier (5) et exchanger lesdites representations Electroniques 
25 d'argent (11 ) avec d'autres modules de transaction (4) dans des transactions en differe, 

lesdites representations electroniques d'argent (11 ) comprenant une date cf expiration, 
les autres modules de transaction (4) comportant des processeurs adaptes pour refuser cfaccepter des trans- 
fers entrepris desdites representations electroniques d'argent (11) lorsque tes transfers entrepris ont lieu 
apres (a date d' expiration desdites representations electroniques d'argent (11). 

30 

1 5. Systeme monetaire electronique suivant la revendication 14, caractertse en ce que le module producteur de mon- 
naie (6) et le module caissier (5) sont reunis dans un dispositif comportant un unique processeur. 

16. Systeme monetaire electronique suivant la revendication 14, caracterise en ce que le systeme de comptabilite 
ss prdcite entretient des comptes de monnaie due et de monnaie en transit, pendant des d£pdts et retraits desdites 

representations electroniques d'argent (11). 

17. Systeme monetaire electronique suivant la revendication 14, caracterise en ce que la date d'expiration varie en 
fonction d'une valeur monetaire associee aux representations electroniques d'argent (11) precitees. 

40 

1 a. Systeme monetaire electronique suivant la revendication 14, caracterise en ce que les representations electroni- 
ques d'argent (11) memortsees dans te module de transaction (4) sont mises a jour lorsqu'il est en transaction 
avec le module caissier (5). 

*s 19. Systeme monetaire electronique suivant la revendication 18, caracterisa en ce que les representations electroni- 
ques d'argent (11) precitees sont mises a jour par le module de transaction (4) en cours de transfer! desdites 
representations electroniques d'argent (11 ) m6morisees vers le module caissier (5), le module producteur de mon- 
naie (6) produisanl une nouvelle representation electronique d'argent (11 ) de remptacement, comportant une nou- 
velle date d'expiration, le module caissier (5) transterant la nouvelle representation electronique d'argent (11) de 

so rempiacement vers le module de transaction (4) p recite. 

20. Systeme monetaire electronique suivant la revendication 14, caracterise en ce que les modules producteur de 
monnaie, caissier, et de transaction (4) sont des dispositifs a Pabri d'une falsification et qui sont a m§me de com- 
muniquer par I'intermediaire de cessions cryptographiquement sOres. 

55 

21. Systeme monetaire electronique suivant la revendication 20, caracterise en ce que chaque module precite peut 
s'engager en inscrtvant une transaction de fa$on a ce qu'll ne puisse plus abandonner I'execution de ladite tran- 
saction en faisant reculer son etat, et en ce que chaque module peut abandonner ('execution pendant ladite tran- 
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sactton en suivant un sous-programme d'abandon programme dans lequel la commando est transferee d'autres 
sous-programmes ou d'un protocole a delai cfattente au sous-programme ©"abandon. 

22. Systeme monetaire electronique comprenant : 

5 

- un systeme de comptabilite commande par ordinate ur, associe a une banque emettrice (1), 

- un module producteur de monnaie (6), associe a ta banque emettrice (1), qui produit des representations 
electroniques d'argent (11), dans lequel un compte d'engagement sur la monnaie emise, du systeme de comp- 
tab&ite, est creciite d'un montant associe a des representations electroniques produites d'argent, 

10 - un module caissier (5) associe a la banque emettrice (1), a m§me de memoriser tesdites representations 

electroniques d'argent (11), et de servir cfintermediaire pour des transactions bancaires impliquant lesdites 

representations electroniques d'argent (11), 
• un module de transaction (4) a meme de memoriser lesdites representations electroniques d'argent (11 ), d'ex6- 

cuter des transactions en ligne avec le module caissier (5) et rfechanger lesdites representations electroniques 
is d'argent (1 1 ) avec d'autres modules de transaction (4) dans des transactions en differe, 

un serveur de securite (27) utilise pour mettre en oeuvre la eecurite du systeme monetaire electronique, 

- le module producteur de monnaie (6), le module caissier (5) et le module de transaction (4) etant associes 
chacun a un identificateur de module unique contenu dans un certificat qui est sign6 numeriquement par le 
serveur de securite (27), les certificats n'etant vatables que pendant une periode de temps limitee, le module 

20 associe n'etant pas a meme de faire des transactions avec d'autres modules apres ce temps, ju&qu'a ce qu'un 

nouveau certificat soit obtenu, 

le nouveau certificat et des identificateurs de modules compromrs etant obtenus lorsque le module effectue 
une premiere connexion de reseau a un r6seau comportant un ou plusieurs serveurs de securite, 
le module ne taisant pas de transaction avec un quelconque autre module comportant un des identificateurs 
25 de modules compromis. 

23. Systeme monetaire electronique suivant la revendication 22, caracterise en ce que le module producteur de mon- 
naie (6) et le module caissier (5) sont reunis dans un dispositif comportant un unique processeur. 

30 24. Systeme monetaire electronique suivant la revendication 22, caracterise en ce que le systeme de comptabilite 
precite entretient des comptes de monnaie due et de monnaie en transit, pendant des depdts et retraits desdites 
representations electroniques d'argent (11). 

25. Systdme monetaire electronique suivant la revendication 22, caracterise en ce que le serveur de securite (27) 
35 distribue, sur demande, une cie de certification. 

26. Systeme monetaire electronique suivant la revendication 22, caracterise en ce que le serveur de s6curit6 (27) 
signe de facon numerique un profil de comple qui comporte des zones de donnees comprenant un identificateur 
de banque, un numero de compte et une indication d'un type de compte, te profil de comple etant utilise par te 

40 module de transaction (4) pour acceder a un compte de titulalre identifie par le num6ro ce compte. 

27. Systeme monetaire electronique suivant la revendication 22, caracterise en ce que le module producteur de mon- 
naie (6), le module caissier (5). le module de transaction (4) et le serveur de securite (27) sont des dispositifs a 
I'abrl d'une falsification, a m§me de communiquer par I'intermediaire de cessions cryptographiquement sures. 

45 

28. Systeme monetaire electronique suivant la revendication 27, caracterise en ce que chaque module precite et le 
serveur de securite (27) peuvent s'engager en inscrivant une transaction de facon a ce qu'ils ne puissent plus 
abandonner l'ex6cution de la transaction en taisant reculer son eiat, et en ce que chaque module el le serveur de 
securite (27) peuvent abandonner rexecution pendant ladite transaction en suivant un sous-programme ©"abandon 

so programme dans lequel la commande est transferee d'autres sous-programmes ou d'un protocole a deiai d'attente 
au sous-programme d'abandon pr6cite. 

29. Systeme monetaire electronique comprenant : 

55 - un systeme de comptabilite commande par ordinateur, associe a une banque emettrice (1 ), 

- un module producteur de monnaie (6). associe a la banque emettrice. qui produit des autorisations (11) de 
credit electroniques, dans lequel une ligne de credit d'un compte de credit d'un titulaire, du systeme de comp- 
tabilite, est accru d'un montant associe a des autorisations de credit electroniques produites, 
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- un module caissier (5) associe a la banque emettrice (1), a m§me de memoriser ladite autorisation de credit 
electronique (1 1 ), et de servir cTintermediaire pourdss transactions bancaires impliquant Pautorisation de credit 
electronique (11) prScitee, 

- un module de transaction (4) a mfime de memoriser ladite autorisation de credit electronique (11), rfexecuter 
des transactions en lignes avec le module caissier (5) et de transferer Pautorisation de credit electronique (11) 
vers un autre module de transaction (4) dans une transaction en difl6re\ et 

- ladite autorisation de credit electronique (11 ) comprenant un numdro de compte du compte de credit du titu- 
laire, un montant monetaire de depart et une signature numerique produite par le module producteur de mon- 
naie (6), 

('autorisation de credit electronique pouvant etre transferee entre des modules de transaction pour un montant 
monetaire transfers inf erieur ou 6gai au montant monetaire de depart, et 

ladKe banque emettrice (1) debrtant du montant monetaire transf6re le compte de credit du titulaire torsque 
Pautorisation de credit electronique (11) est d6pos6e. 

30. Systems monetaire electronique suivant la revendicatton 29, caract6risd en ce que le module producteur de mon- 
naie (6) et le module caissier (5) sont r6unis dans un disposal comportant un unique processeur. 

31. Systeme monetaire electronique suivant la revendicatlon 29, caract6rise en ce que le syst6me de comptabilite 
entretient des comptes de monnaie due et de monnaie en transit, pendant des depots et retrarts de ladite autori- 
sation de credit electronique (11). 

32. Systeme monetaire electronique suivant la revendication 29, caract6ris6 en ce que le module de transaction (4) 
ne peut transferer qu'une fois Pautorisation de credit electronique (11) a un autre module de transaction (4). 

33. Systeme monetaire electronique suivant la revendication 29, caracterise en ce que les modules producteur de 
monnaie, caissier, et de transaction (4) sont des dispositifs a Pabri d'une falsification et qui sont a meme de com- 
muniquer par Pintermediaire de cessions cryptographiquement sOres. 

34. Systeme monetaire electronique suivant la revendication 33, caracterise en ce que Pautorisation de credit elec- 
tronique (11) com p rend des signatures numeriques produces par les modules caissier et de transaction (5, 4) lors 
d'un transfert de ladite autorisation de credit electronique (11 ), et en ce que le module producteur de monnaie (6), 
le module caissier (5) et le module de transaction (4) sont associes chacun a un certificat electronique par lequel 
d'autres modules peuvent verifier leur authenticity le transfert de Pautorisation de credit electronique (11) par le 
module de transaction (4) vers Pautre module de transaction (4) precite pouvant etre execute sans une identification 
du titulaire. 

35. Systeme monetaire electronique suivant la revendication 33, caracterise en ce que chaque module precite peut 
s'engager en inscrivant une transaction de fagon a ce qu'il ne puisse plus abandonner Pex ecu lion de ladite tran- 
saction en faisant reculer son etat, et en ce que chaque module peut abandonner Pexecution pendant ladite tran- 
saction en suivant un sous-programme d'abandon programme dans lequel la commande est transferee d'autres 
sous-programmes ou d'un protocole a deiai tfattente au sous-programme d'abandon. 

36. Systeme monetaire electronique suivant la revendication 29. caracterise en ce que le module de transaction (4) 
est a meme de memoriser tant des representations electroniques d'argent (11) que des autorisations de credit 
eiectroniques (1 1 ), et en ce que (e module de transaction (4) peut transferer tant des representations electroniques 
d'argent (11) que des autorisations de credit electroniques (11) dans un transfert de transaction unique vers Pautre 
module de transaction (4) precite par Pintermediaire de cessions cryptographiquement sOres. 

37. Systems monetaire electronique comprenant 

- un premier systeme de comptabilite commande par ordinateur, associe a une banque emettrice (1 ), 

un module producteur de monnaie, associe a la banque emettrice (1), qui produit des representations elec- 
troniques d'argent, dans lequel un compte d'engagement sur la monnaie emise, du premier systems de comp- 
tabilite, est credite d'un montant associe a des representations electroniques d'argent produites, 
un premier module caissier (5), associe a la banque emettrice (1 ), a m£me de memoriser lesditss represen- 
tations electroniques d'argent ( 1 1 ), 

- une pluralite de seconds systemes de comptabilite commandes par ordinateur. chacun etant associe a une 
banque correspondante (2), chaque banque correspondante conservant un compte dans ledit premier syste- 
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me de comptabiiitE, 

- une plurality de seconds modules caissiers (5), chacun Etant associE k une des banques correspondantes 
(2), chacun Etant k meme de mEmoriser lesdhes representations Electroniques d'argent (11), 

- un module de transaction (4) qui memorise lesdites reprEsentations Electroniques d'argent (11 ), qui execute 
s des transactions en ligne avec (a plurality de seconds modules caissiers (5) et qui echange lescltes reprE- 

sentations Electroniques cfargent (11) avec cTautres modules de transaction (4) dans des transactions en 
differs 

le premier module caissier (5) comportant un premier processeur qui sert d'intermediaire pour des transactions 
entre le premier systeme de comptabiiitE, le module producteur de monnaie (6) et le second module caissier 
(5). et 

- le second module caissier (5) comportant un second processeur qui sert dMntermEdiaire pour des transactions 
entre le second systeme de comptabiiitE, le premier module caissier (5) et le module de transaction (4). 

38. Systeme monetaire Electronique suivant la revendication 37, caractErisE en ce que le module de transaction (4) 
is execute Egalement des transactions en llgne avec le module caissier (5) et en ce que le premier module caissier 

(5) sert Egalement cfintermEdiaire pour des transactions impliquant le module de transaction (4). 

39. Systeme monetaire electronique suivant la revendication 37, caractErisE en ce que le module producteur de mon- 
naie (6) et le premier module caissier (5) sont rEunis dans un disposftif de traitement Electronique commande par 

20 le premier processeur. 

40. Systems monEtalre Electron ique suivant la revendication 37, caractErisE en ceque les premier et second systemes 
de comptabiiitE entretiennent des comptes de monnaie due et de monnaie en transit, pendant des dEp6ts et retraits 
desdites representations Electroniques d'argent (11). 

25 

41. Systeme monEtaire Electronique suivant la revencfication 37, caractErisE en ce que les modules producteur de 
monnaie, detransaction et caissiers (6, 4. 5) sont desdispositifs k I'abri d'une falsification, k mEme de communiquer 
par I'intermEdiaire de cessions cryptograph iquement sQres. 

30 42. Systeme monetaire Electronique suivant la revendication 41, caractErisE en ce que chaque module susdit peut 
s'engager en inscrivant une transaction de facon a. ce qu'il ne puisse plus suspendre I'exEcution de ladite transac- 
tion en faisant reculer son Etat, et en ce que chaque module peut abandonner ('execution pendant ladite transaction 
en suivant un sous-programme d'abandon programme dans lequel la commande est transfErEe cfautres sous- 
programmes ou d'un protocols k dElal cfattente au sous-programme d'abandon. 

3$ 

43. Systeme monEtaire Electronique comprenant 

une plurality de systemes de comptabilite commandes par ordinate ur, associes k une plurality de banques 
Emettrices (1), 

40 . une plurality de modules producteurs de monnaie (6), associEs k la plurality de banques Emettrices (1), qui 
produisant des representations Electroniques d'argent (11 ), des comptes d'engagement sur la monnaie Emise, 
desdits systemes de comptabilite, Etant crEditEs de montants associes a des representations Electroniques 
produites cfargent, 

une plurality de modules caissiers (5), associEs k la plurality de banques Emettrices (1 ), k meme de mEmoriser 
45 les representations Electroniques cfargent (11 ) susdites, 

un systeme de traitement de donnees associE k une banque de compensation qui compense les reprEsen- 
tations Electroniques d'argent et qui entretient un systeme de comptabilitE de banque de compensation dans 
lequel ladite plurality de banques Emettrices ont chacun e un comple, 

chacune des reprEsentations Electroniques'd'argent (11 ) comprenant un identitlcateur de banque Emettrice, et 
so . chacun de la plurality des modules caissiers (5) envoyant des reprEsentations Electroniques d'argent (11), 
dEposEes k sa banque Emettrice (1) mais Emises par une autre banque Emettrice (1), k la banque de com- 
pensation (3) pour compenser les comptes de banques emettrices prEcitEs et pour envoyer chaque represen- 
tation Electronique d'argent (11 ) en retour k la banque Emetlrice (1 ) indiquee par son identrficateur de banque 
Emettrice. 

55 

44. Systeme monetaire Electronique suivant la revendication 43, caractErisE en ce qu'au moins un des modules pro- 
ducteurs de monnaie (6) et un des modules caissiers (5) sont rEunis dans un dispositif comportant un unique 
processeur. 
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45. Systeme monEtaire Electronique suivant la revendication 43. caractErisE en ce que les system es de comptabilitE 
entretiennent des comptes de monnaie en transit el de monnaie due. pendant une compensation desdites reprE- 
sentations Electroniques d'argent (11). 

5 46. Systeme monEtaire Electronique suivant la revendication 43, caractErisE en ce que lee modules producteurs de 
monnaie (6) et les modules calsslers (5) sont des dlspositits a Pabri de falsifications, a meme de communiquer par 
iintermEdiaire de cessions cryptograpntquemenl sOres. 

47. Systeme monetaire electronique suivant la revendication 46, caractErisE en ce que chaque module susdit peut 
io ^engager en inscrivant une transaction de (aeon a ce qu'il ne puisse plus abandonner rexecution de ladite tran- 
saction en faisant reculer son Etat. et en ce que chaque module peut abandonner ('execution pendant ladite tran- 
saction en suivant un sous-programme d'abandon programme dans lequel la commando est transfErEe d'autres 
sous-programmes ou d'un protocole a delai cfattente au sous-programme d'abandon. 

48. Systeme monetaire electronique comprenant 

• une pturalitE de systemes de comptabilitE commandos par ordinateur, associEs a une pluralite de banques 
Emettrices (1), 

- une pluralite de modules producteurs de monnaie (6). associEs a la pluralite de banques emettrices, qui pro- 
20 duisent des autorisations de credit Electroniques (11). des lignes de credit de comptes de crEdit de tHulaire. 

desdits systemes de comptabilite, etant accrus par des montants associes a des autorisations de credit elec- 
troniques produites, 

- une pluralite de modules calsslers (5) associes a ladite pluralite de banques emettrices (1 ), a meme de mE- 
moriser les autorisations de credit electroniques (11), 

25 - un systeme de traitement de donnees, associ6 a une banque de compensation, qui compense lee autorisations 

de credit electroniques et qui entretient un systeme de comptabilite de banque de compensation dans lequel 
la plurality de banques emettrices ont chacune un compte, 

- chacune des autorisations de credit electroniques (11 ) comportant un identificateur de banque Emettrice, et 

- chacun de la pluralite des modules caissiers (5) envoyant des autorisations de credit electroniques (11). dE- 
30 posees a sa banque Emettrice (1) mais Emises par une autre banque Emettrice (1). a la banque de compen- 
sation (3) pour compenser les comptes de banques emettrices et pour envoyer chaque autorisation de credit 
electronique (11) precitee en retour a ta banque emettrice (1) uidiquee par son identificateur de banque emet- 
trice. 

35 49. Systeme monetaire electronique suivant la revendication 48, caractErisE en ce qu'au moins un des modules pro- 
ducteurs de monnaie (6) et un des modules caissier6 (5) sont reunis dans un dispositif comportant un unique 
processeur. 

50. Systeme monetaire Electronique suivant la revendication 48, caractErisE en ce que les systemes de comptabilite 
40 precites entretiennent des comptes de monnaie en transit et de monnaie due, pendant une compensation des 

autorisations de credit electroniques (11) prEcitEes. 

51. Systeme monetaire Electronique suivant la revendication 48, caractErisS en ce que les modules producteursde 
monnaie (6) et les modules caissiers (5) sont des dispositils a fabii cfune falsification, a meme de communiquer 

45 par des cessions cryptographiquement sGres. 

52. Systeme monetaire electronique suivant la revendication 51. caractErisE en ce que chaque module precite peut 
s'engager en inscrivant une transaction de (aeon a ce qu'il ne puisse plus abandonner rexecution de ladite tran- 
saction en faisant reculer son Stat, et en ce que chaque module peut abandonner Texecution pendant ladite tran- 

so saction en suivant un sous-programme d'abandon programme dans lequel (a commande est transferee d'autres 

sous-programmes ou d'un protocole a delai cfattente au sous-programme d'abandon. 

53. Systeme monetaire Electronique comprenant 

55 - un systeme de comptabilite commande par ordinateur et, associE & une banques Emettrice (1 ), un systeme 

de reconciliation (23) de monnaie Emise, mis en oeuvre par ordinateur, 

- un module producteur de monnaie, associE a la banque Emettrice, qui produit des reprEsentations Electroni- 
ques de monnaie (11) qui sont justitiees dans un systEme de comptabilitE, 
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- un module caissier (5) associe k la banque emettrice (1), k m6me de memoriser les representations eiectro- 
niques de monnaie (11). 

les representations eiectroniques de monnaie (11) comprenant un identificateur de billet utilise pour identifier 
de tacon unique chaque representation eiectronique de monnaie (1 1 ), et une liste tfenregistrements de trans- 
s tens pour foumir une possibility de subdivlser des vaieurs de chaque representation eiectronique de monnaie, 

le systeme de reconciliation (23) de monnaie emise conservant un enregistrement, derive du module produc- 
teur de monnaie, des representations eiectroniques de monnaie (1 1 ) qui ont ete emises par la banque emettrice 

des representations eiectroniques de monnaie (11), qui sont deposees, etant envoy6es au systeme de reoon- 
10 ciliation (23) de monnaies emises qui a un processeur pour mettre en correspondance Tenregistrement de 

representations eiectroniques de monnaie (11) qui ont ete emises et ces representations eiectroniques sub- 
drvisees de monnaie (11) deposees et 

- des cas qui ne correspondent pas pouvant indiquer une contrefagon de billet dans le systeme monetaire 
eiectronique. 

75 

54. Systeme monetaire eiectronique suivant la revendication 53, caracterise en ce que (e module producteur de mon- 
naie (6) et le module caissier (5) sont r6unis dans un dispostttf component un processeur unique. 

55. Systeme monetaire eiectronique suivant la revendication 53, caracterise en ce que chaque module prtote peut 
20 s'engager en inscrivant une transaction de facon k ce qu'il ne puisse plus abandonner Pex6cution de ladite tran- 
saction en faisant reculer son 6tat, et en ce que chaque module peut abandonner ('execution pendant ladite tran- 
saction en suivant un sous-programme d'abandon programme dans lequet ta commande est transferee d'autres 
sous-programmes ou d'un protocole k deiai tfattente au sous-programme d'abandon. 

2s 56. Systeme monetaire eiectronique comprenant 

un systeme de comptabilite commande par ordinateur et, associe k une banque emettrice (1 ), un systeme de 
reconciliation (22) de transaction, mis en oeuvre par ordinateur, 

un module producteur de monnaie, associe k ta banque emettrice, qui produil des representations electron i- 
30 ques de monnaie qui sont justifies dans le systeme de comptabilite, 

un module caissier (5) associe k ta banque Emettrice (1), k mdme de memoriser les representations eiectro- 
niques de monnaie (11), 

des enregistrements de transaction en provenance du module producteur de monnaie (6), du module caissier 
(5) et du systdme de comptabilite en iigne etant periodtquement passes au systeme de reconciliation de tran- 
3S saction (22), 

le systeme de reconciliation de transaction (22) comportant un processeur pour analyser les enregistrements 
de transactions afin de s'assurer que des transactions du caissier correspondent aux transactions de comp- 
tabilite appropriees et de s'assurer que des transactions du module producteur de monnaie correspondent 
aux transactions de caissier et aux transactions da comptabilite appropriees, et 
40 - toute absence de correspondance pouvant indiquer un traitement incomplet ou une violation de la securite. 

57. Systems monetaire eiectronique suivant la revendication 56, caracterise en ce que le module producteur de mon- 
naie (6) et te module caissier (5) sont r6unis dans un dispositif comportant un processeur unique. 

45 58. Systeme monetaire eiectronique suivant la revendication 56, caracterise en ce que chaque module precite peut 
s'engager en inscrivant une transaction de facon k ce qu'il ne puisse plus abandonner ('execution de ladite tran- 
saction en faisant reculer son etat, et en ce que chaque module peut abandonner I'execution pendant ladite tran- 
saction en suivant un sous-programme d'abandon programme dans lequel la commande est transferee d'autres 
sous-programmes ou d'un protocole a deiai cfattente au sous-programme d'abandon. 
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